WaratekVRT Sign in

CVE-2024-39689 Certifi

Affected softwareCertifi
Severity7.5 High CVSS 3.1 2 scores
WeaknessCWE-345
Published5 Jul 2024
Updated17 Jun 2026

Description

Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi starting in 2021.5.30 and prior to 2024.7.4 recognized root certificates from GLOBALTRUST. Certifi 2024.7.04 removes root certificates from GLOBALTRUST from the root store. These are in the process of being removed from Mozilla's trust store. GLOBALTRUST's root certificates are being removed pursuant to an investigation which identified "long-running and unresolved compliance issues."

Exploitation status

No public exploit

No exploit has been reported in the sources we check. The 1 repository below are public GitHub repositories with fewer than 5 stars.
  • CISA KEV not listed
  • VulnCheck KEV not listed
  • CISA Vulnrichment exploitation: none
  • Indexed PoC 1 indexed, none at 5+ stars
  • EPSS 1.0% chance in 30 days

1 of these are GitHub repositories with fewer than 5 stars. They are listed for reference and don't count toward the exploitation status above.

IndexArtifactStarsFirst seen
GitHub PoC DO NOT FORK, DEPLOY, OR USE FOR ANYTHING BUT LEARNING. These requirements are vulnerable to CVE-2024-39689 2024-03-20

Waratek protection

Outside Waratek scope

A Java vulnerability, but not one Waratek protects. It affects only Java on a user's desktop (applets, Web Start, JavaFX, the installer), sits in a product the Waratek agent can't be installed into, or is in a package we don't expect in business applications. The decision below says which.

  • Protection none
  • Action not pursued none
  • Review human Researcher
  • Record active
Decided by Manual classification of this CVE in the legacy dataset
Finding A manual classification set this CVE's status to Outside Waratek scope, but the CVE names a tracked product.

CVSS

7.5 HIGH v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N 2 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N security-advisories@github.com Secondary published
CVSS 3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N NVD Primary

Affected software and releases

Products and versions

4 products, 4 version entries
SourceVendorProductSchemeAffected versions
nvd certifi certifi generic ≥ 2021.5.30 and ＜ 2024.7.4
nvd netapp management services for element software and netapp hci generic any version
nvd netapp ontap select deploy administration utility generic any version
nvd netapp ontap tools generic 10

References

URLTags
https://github.com/certifi/python-certifi/commit/bd8153872e9c6fc98f4023df9c2deaffea2fa463 Patch
https://github.com/certifi/python-certifi/security/advisories/GHSA-248v-346w-9cwc Vendor Advisory
https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/XpknYMPO8dI Mailing List
https://security.netapp.com/advisory/ntap-20241206-0001/ Third Party Advisory

Timeline
Published2024-07-05By the CVE Program.
NVD record modified2026-06-17NVD's own last-modified date for this record.