CVE-2024-39689

Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi starting in 2021.5.30 and prior to 2024.7.4 recognized root certificates from `GLOBALTRUST`. Certifi 2024.7.04 removes root certificates from `GLOBALTRUST` from the root store. These are in the process of being removed from Mozilla's trust store. `GLOBALTRUST`'s root certificates are being removed pursuant to an investigation which identified "long-running and unresolved compliance issues."

• CWE-345
• CWE-345

• https://github.com/certifi/python-certifi/commit/bd8153872e9c6fc98f4023df9c2deaffea2fa463Patch
• https://github.com/certifi/python-certifi/security/advisories/GHSA-248v-346w-9cwcVendor Advisory
• https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/XpknYMPO8dIMailing List
• https://github.com/certifi/python-certifi/commit/bd8153872e9c6fc98f4023df9c2deaffea2fa463Patch
• https://github.com/certifi/python-certifi/security/advisories/GHSA-248v-346w-9cwcVendor Advisory
• https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/XpknYMPO8dIMailing List
• https://security.netapp.com/advisory/ntap-20241206-0001/Third Party Advisory

Published

Jul 5, 2024

Last Modified

Jun 17, 2026

Status

Modified

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-39683ZITADEL is an open-source identity infrastructure tool. ZITA…6.5
• CVE-2024-39684Tencent RapidJSON is vulnerable to privilege escalation due …7.8
• CVE-2024-39685Bert-VITS2 is the VITS2 Backbone with multilingual bert. Use…9.8
• CVE-2024-39686Bert-VITS2 is the VITS2 Backbone with multilingual bert. Use…9.8
• CVE-2024-39687Fedify is a TypeScript library for building federated server…7.2
• CVE-2024-39688Bert-VITS2 is the VITS2 Backbone with multilingual bert. Use…6.5
• CVE-2024-3969XML External Entity injection vulnerability found in OpenTex…9.8
• CVE-2024-39690Capsule is a multi-tenancy and policy-based framework for Ku…8.8
• CVE-2024-39691matrix-appservice-irc is a Node.js IRC bridge for the Matrix…4.3
• CVE-2024-39693Next.js is a React framework. A Denial of Service (DoS) cond…7.5
• CVE-2024-39694Duende IdentityServer is an OpenID Connect and OAuth 2.x fra…4.7
• CVE-2024-39695Exiv2 is a command-line utility and C++ library for reading,…6.5