CVE-2024-39689

HIGH

certifi 2021.5.30-2024.7.4 - Insufficient Verification of Data Authenticity via GLOBALTRUST Root Certificates

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2024-39689. PoCs published by roy-aladin.

AI-analyzed exploit summary The repository contains a basic FastAPI application with a warning about CVE-2024-39689 but no actual exploit code or technical details. It references a vulnerability in Certifi but does not demonstrate or explain the exploit.

Description

Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi starting in 2021.5.30 and prior to 2024.7.4 recognized root certificates from `GLOBALTRUST`. Certifi 2024.7.04 removes root certificates from `GLOBALTRUST` from the root store. These are in the process of being removed from Mozilla's trust store. `GLOBALTRUST`'s root certificates are being removed pursuant to an investigation which identified "long-running and unresolved compliance issues."

Exploits (1)

nomisec STUB

by roy-aladin · poc

https://github.com/roy-aladin/InfraTest

View Code ZIP pw:eip

The repository contains a basic FastAPI application with a warning about CVE-2024-39689 but no actual exploit code or technical details. It references a vulnerability in Certifi but does not demonstrate or explain the exploit.

Classification

Stub 90%

Attack Type

Other

Complexity

Trivial

Reliability

Theoretical

Target: Certifi (version not specified)

No auth needed

Prerequisites: None

devstral-2 · analyzed Feb 18, 2026 Full analysis →

References (4)

Core 4

Core References

Third Party Advisory

https://security.netapp.com/advisory/ntap-20241206-0001/

Vendor Advisory x_refsource_confirm

https://github.com/certifi/python-certifi/security/advisories/GHSA-248v-346w-9cwc

Patch x_refsource_misc

https://github.com/certifi/python-certifi/commit/bd8153872e9c6fc98f4023df9c2deaffea2fa463

View Patch ZIP pw:eip

Mailing List x_refsource_misc

https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/XpknYMPO8dI

Scores

CVSS v3 7.5

EPSS 0.2581

EPSS Percentile 96.4%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-345

Status published

Products (5)

certifi/certifi 2021.5.30 - 2024.7.4

netapp/management_services_for_element_software_and_netapp_hci

netapp/ontap_select_deploy_administration_utility

netapp/ontap_tools 10

pypi/certifi 2021.5.30 - 2024.7.4PyPI

Published Jul 05, 2024

Tracked Since Feb 18, 2026