CVE-2024-39689

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-39689
Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi starting in 2021.5.30 and prior to 2024.7.4 recognized root certificates from `GLOBALTRUST`. Certifi 2024.7.04 removes root certificates from `GLOBALTRUST` from the root store. These are in the process of being removed from Mozilla's trust store. `GLOBALTRUST`'s root certificates are being removed pursuant to an investigation which identified "long-running and unresolved compliance issues."

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/certifi/python-certifi/commit/bd8153872e9c6fc98f4023df9c2deaffea2fa463 Patch
https://github.com/certifi/python-certifi/security/advisories/GHSA-248v-346w-9cwc Vendor Advisory
https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/XpknYMPO8dI Mailing List
https://github.com/certifi/python-certifi/commit/bd8153872e9c6fc98f4023df9c2deaffea2fa463 Patch
https://github.com/certifi/python-certifi/security/advisories/GHSA-248v-346w-9cwc Vendor Advisory
https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/XpknYMPO8dI Mailing List
https://security.netapp.com/advisory/ntap-20241206-0001/ Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:certifi:certifi:*:*:*:*:*:python:*:*

Configuration 2 (hide)

OR cpe:2.3:a:netapp:management_services_for_element_software_and_netapp_hci:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:ontap_tools:10:*:*:*:*:vmware_vsphere:*:*
History

15 Feb 2025, 00:15

Type Values Removed Values Added
Summary (en) Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi starting in 2021.05.30 and prior to 2024.07.4 recognized root certificates from `GLOBALTRUST`. Certifi 2024.07.04 removes root certificates from `GLOBALTRUST` from the root store. These are in the process of being removed from Mozilla's trust store. `GLOBALTRUST`'s root certificates are being removed pursuant to an investigation which identified "long-running and unresolved compliance issues." (en) Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi starting in 2021.5.30 and prior to 2024.7.4 recognized root certificates from `GLOBALTRUST`. Certifi 2024.7.04 removes root certificates from `GLOBALTRUST` from the root store. These are in the process of being removed from Mozilla's trust store. `GLOBALTRUST`'s root certificates are being removed pursuant to an investigation which identified "long-running and unresolved compliance issues."

12 Feb 2025, 20:12

Type Values Removed Values Added
First Time Netapp ontap Select Deploy Administration Utility
Netapp management Services For Element Software And Netapp Hci
Certifi
Netapp
Netapp ontap Tools
Certifi certifi
References () https://github.com/certifi/python-certifi/commit/bd8153872e9c6fc98f4023df9c2deaffea2fa463 - () https://github.com/certifi/python-certifi/commit/bd8153872e9c6fc98f4023df9c2deaffea2fa463 - Patch
References () https://github.com/certifi/python-certifi/security/advisories/GHSA-248v-346w-9cwc - () https://github.com/certifi/python-certifi/security/advisories/GHSA-248v-346w-9cwc - Vendor Advisory
References () https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/XpknYMPO8dI - () https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/XpknYMPO8dI - Mailing List
References () https://security.netapp.com/advisory/ntap-20241206-0001/ - () https://security.netapp.com/advisory/ntap-20241206-0001/ - Third Party Advisory
CPE cpe:2.3:a:netapp:management_services_for_element_software_and_netapp_hci:-:*:*:*:*:*:*:*
cpe:2.3:a:certifi:certifi:*:*:*:*:*:python:*:*
cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:ontap_tools:10:*:*:*:*:vmware_vsphere:*:*

06 Dec 2024, 14:15

Type Values Removed Values Added
References
  • () https://security.netapp.com/advisory/ntap-20241206-0001/ -
Information

Published : 2024-07-05 19:15

Updated : 2025-02-15 00:15

NVD link : CVE-2024-39689

Mitre link : CVE-2024-39689

CVE.ORG link : CVE-2024-39689

JSON object : View

Products Affected

netapp

  • management_services_for_element_software_and_netapp_hci
  • ontap_select_deploy_administration_utility
  • ontap_tools

certifi

  • certifi
CWE
CWE-345

Insufficient Verification of Data Authenticity