---
id: CVE-2024-39689
aliases:
  - GHSA-248v-346w-9cwc
  - PYSEC-2024-230
title: Certifi removes GLOBALTRUST root certificate
summary: Certifi removes GLOBALTRUST root certificate
severity: low
vendor: certifi
product: certifi
ecosystem: pip
affected:
  - 'certifi >= 2021.5.30, < 2024.7.4'
patched:
  - certifi 2024.7.4
published: '2024-07-05'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:50:15.994602411Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-248v-346w-9cwc'
references:
  - url: >-
      https://github.com/certifi/python-certifi/security/advisories/GHSA-248v-346w-9cwc
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2024-39689'
  - url: >-
      https://github.com/certifi/python-certifi/commit/bd8153872e9c6fc98f4023df9c2deaffea2fa463
  - url: 'https://github.com/certifi/python-certifi'
  - url: >-
      https://github.com/pypa/advisory-database/tree/main/vulns/certifi/PYSEC-2024-230.yaml
  - url: >-
      https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/XpknYMPO8dI
  - url: 'https://security.netapp.com/advisory/ntap-20241206-0001'
tags:
  - osv
  - pip
  - exploit-available
epss: 0.01049
epssPercentile: 0.62708
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/roy-aladin/InfraTest'
  checkedAt: '2026-09-25T08:20:43.296Z'
exploitAvailable: true
ingestedAt: '2026-09-12T03:13:01.632Z'
---

## Overview

Certifi 2024.07.04 removes root certificates from "GLOBALTRUST" from the root store. These are in the process of being removed from Mozilla's trust store.

GLOBALTRUST's root certificates are being removed pursuant to an investigation which identified "long-running and unresolved compliance issues". Conclusions of Mozilla's investigation can be found [here]( https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/XpknYMPO8dI).

## Affected packages

- `certifi >= 2021.5.30, < 2024.7.4`

## Remediation

Upgrade to a patched release:

- `certifi 2024.7.4`