CVE catalog

CVE-2024-39689

python-certifi: CVE-2024-39689

[CVE catalog]

Severity
Low · CVSS 3.7CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Published
Source
[NVD] · [CVE record]
EPSS
1.05% · Oct 25, 2026

Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi starting in 2021.5.30 and prior to 2024.7.4 recognized root certificates from `GLOBALTRUST`. Certifi 2024.7.04 removes root certificates from `GLOBALTRUST` from the root store. These are in the process of being removed from Mozilla's trust store. `GLOBALTRUST`'s root certificates are being removed pursuant to an investigation which identified "long-running and unresolved compliance issues."

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianpython-certifisid2026.10.19+ds-1fixed
Debianpython-certififorky2026.10.19+ds-1fixed
Debianpython-certifitrixie2025.1.31+ds-1fixed
Debianpython-certifibookworm2022.9.24-1vulnerable
PyPIcertifiNot reported2024.7.4fixed
PyPIcertifiNot reported2024.7.4fixed
PyPIcertifiNot reportedbd8153872e9c6fc98f4023df9c2deaffea2fa463fixed
Opensusepython-certifitumbleweed2024.7.4-1.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianpython-certifisourcesid2024.8.30-1unimportantNot reportedNot reported
Debianpython-certifisourceforky2024.8.30-1unimportantNot reportedNot reported
Debianpython-certifisourcetrixie2024.8.30-1unimportantNot reportedNot reported
Debianpython-certifisourcebookworm(unfixed)unimportantNot reportedNot reported
PyPIcertifiPyPINot reported2024.7.4Not reportedGHSA-248V-346W-9CWCNot reported
PyPIcertifiPyPINot reported2024.7.4Not reportedNot reportedNot reported
PyPIcertifiPyPINot reportedbd8153872e9c6fc98f4023df9c2deaffea2fa463Not reportedNot reportedNot reported
Opensusepython-certifirpmtumbleweed2024.7.4-1.1Not reportedOPENSUSE-SU-2024:14118-1Not reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [python3-certifi]Affected

    Source package: [python-certifi]

    Details (2)

    • 2022.9.24-1 · all · bookworm

      Affected

      dsa · python-certifi · debian · bookworm; dsa · python-certifi · debian · 12

    • 2022.9.24-1 · all · bookworm

      Affected

      dsa · python-certifi · debian · bookworm; dsa · python-certifi · debian · 12

[openSUSE Tumbleweed]

  • [python313-certifi]Unknown

    Source package: [python-certifi]

    Details (1)

    • 2026.7.22-1.1 · noarch · tumbleweed

      Unknown · Fixed: 2024.7.4-1.1

      Version impact unknown

      dsa · python-certifi · opensuse · tumbleweed

  • [python314-certifi]Unknown

    Source package: [python-certifi]

    Details (1)

    • 2026.7.22-1.1 · noarch · tumbleweed

      Unknown · Fixed: 2024.7.4-1.1

      Version impact unknown

      dsa · python-certifi · opensuse · tumbleweed

[Debian 13 (Trixie)]

  • [python3-certifi]Fixed

    Source package: [python-certifi]

    Details (2)

    • 2025.1.31+ds-1 · all · trixie

      Fixed · Fixed: 2024.8.30-1

      dsa · python-certifi · debian · 13

    • 2025.1.31+ds-1 · all · trixie

      Fixed · Fixed: 2024.8.30-1

      dsa · python-certifi · debian · 13

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]