pysec - pysec-2024-230

pysec-2024-230

Vulnerability from pysec

Published

2024-07-05 19:15

Modified

2025-02-12 21:21

Severity ?

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Details

Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi starting in 2021.05.30 and prior to 2024.07.4 recognized root certificates from GLOBALTRUST. Certifi 2024.07.04 removes root certificates from GLOBALTRUST from the root store. These are in the process of being removed from Mozilla's trust store. GLOBALTRUST's root certificates are being removed pursuant to an investigation which identified "long-running and unresolved compliance issues."

Aliases

CVE-2024-39689

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "certifi",
        "purl": "pkg:pypi/certifi"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "bd8153872e9c6fc98f4023df9c2deaffea2fa463"
            },
            {
              "fixed": "bd8153872e9c6fc98f4023df9c2deaffea2fa463"
            }
          ],
          "repo": "https://github.com/certifi/python-certifi",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "2021.5.30"
            },
            {
              "fixed": "2024.7.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2021.10.8",
        "2021.5.30",
        "2022.12.7",
        "2022.5.18",
        "2022.5.18.1",
        "2022.6.15",
        "2022.6.15.1",
        "2022.6.15.2",
        "2022.9.14",
        "2022.9.24",
        "2023.11.17",
        "2023.5.7",
        "2023.7.22",
        "2024.2.2",
        "2024.6.2"
      ]
    }
  ],
  "aliases": [
    "CVE-2024-39689"
  ],
  "details": "Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi starting in 2021.05.30 and prior to 2024.07.4 recognized root certificates from `GLOBALTRUST`. Certifi 2024.07.04 removes root certificates from `GLOBALTRUST` from the root store. These are in the process of being removed from Mozilla\u0027s trust store. `GLOBALTRUST`\u0027s root certificates are being removed pursuant to an investigation which identified \"long-running and unresolved compliance issues.\"",
  "id": "PYSEC-2024-230",
  "modified": "2025-02-12T21:21:51.559667+00:00",
  "published": "2024-07-05T19:15:10+00:00",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://github.com/certifi/python-certifi/security/advisories/GHSA-248v-346w-9cwc"
    },
    {
      "type": "ADVISORY",
      "url": "https://security.netapp.com/advisory/ntap-20241206-0001/"
    },
    {
      "type": "ARTICLE",
      "url": "https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/XpknYMPO8dI"
    },
    {
      "type": "FIX",
      "url": "https://github.com/certifi/python-certifi/commit/bd8153872e9c6fc98f4023df9c2deaffea2fa463"
    }
  ],
  "related": [
    "GHSA-248v-346w-9cwc",
    "GHSA-248v-346w-9cwc"
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

cve-2024-39689

Vulnerability from cvelistv5

Published

2024-07-05 18:39

Modified

2025-02-14 23:19

Severity ?

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Summary

Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi starting in 2021.5.30 and prior to 2024.7.4 recognized root certificates from `GLOBALTRUST`. Certifi 2024.7.04 removes root certificates from `GLOBALTRUST` from the root store. These are in the process of being removed from Mozilla's trust store. `GLOBALTRUST`'s root certificates are being removed pursuant to an investigation which identified "long-running and unresolved compliance issues."

References

▼	URL	Tags
	https://github.com/certifi/python-certifi/security/advisories/GHSA-248v-346w-9cwc	x_refsource_CONFIRM
	https://github.com/certifi/python-certifi/commit/bd8153872e9c6fc98f4023df9c2deaffea2fa463	x_refsource_MISC
	https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/XpknYMPO8dI	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	certifi	python-certifi	Version: >= 2021.5.30, < 2024.7.4

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-39689",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-05T20:06:09.735041Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-05T20:06:22.343Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-12-06T13:09:31.501Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://github.com/certifi/python-certifi/security/advisories/GHSA-248v-346w-9cwc",
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/certifi/python-certifi/security/advisories/GHSA-248v-346w-9cwc"
          },
          {
            "name": "https://github.com/certifi/python-certifi/commit/bd8153872e9c6fc98f4023df9c2deaffea2fa463",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/certifi/python-certifi/commit/bd8153872e9c6fc98f4023df9c2deaffea2fa463"
          },
          {
            "name": "https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/XpknYMPO8dI",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/XpknYMPO8dI"
          },
          {
            "url": "https://security.netapp.com/advisory/ntap-20241206-0001/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "python-certifi",
          "vendor": "certifi",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 2021.5.30, \u003c 2024.7.4"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi starting in 2021.5.30 and prior to 2024.7.4 recognized root certificates from `GLOBALTRUST`. Certifi 2024.7.04 removes root certificates from `GLOBALTRUST` from the root store. These are in the process of being removed from Mozilla\u0027s trust store. `GLOBALTRUST`\u0027s root certificates are being removed pursuant to an investigation which identified \"long-running and unresolved compliance issues.\""
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-345",
              "description": "CWE-345: Insufficient Verification of Data Authenticity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-02-14T23:19:13.111Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/certifi/python-certifi/security/advisories/GHSA-248v-346w-9cwc",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/certifi/python-certifi/security/advisories/GHSA-248v-346w-9cwc"
        },
        {
          "name": "https://github.com/certifi/python-certifi/commit/bd8153872e9c6fc98f4023df9c2deaffea2fa463",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/certifi/python-certifi/commit/bd8153872e9c6fc98f4023df9c2deaffea2fa463"
        },
        {
          "name": "https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/XpknYMPO8dI",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/XpknYMPO8dI"
        }
      ],
      "source": {
        "advisory": "GHSA-248v-346w-9cwc",
        "discovery": "UNKNOWN"
      },
      "title": "Certifi removes GLOBALTRUST root certificate"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-39689",
    "datePublished": "2024-07-05T18:39:33.202Z",
    "dateReserved": "2024-06-27T18:44:13.035Z",
    "dateUpdated": "2025-02-14T23:19:13.111Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted