Critical Vulnerability in Python Pip and Certifi Packages: CVE-2024-39689
Summary
UBUNTU-CVE-2024-39689: Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Affects python-pip versions 1.4.1-2 – 1.5.4-1ubuntu4+esm5. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python Pip is a package management system used to install and manage software packages written in Python. Certifi is a Python package that provides a curated collection of Root Certificates for validating the trustworthiness of SSL certificates. Both packages are widely used in various applications, making them critical components in the Python ecosystem. The vulnerability identified as CVE-2024-39689 affects these packages due to their reliance on outdated root certificates from GLOBALTRUST, which have been flagged for compliance issues.
Vulnerability Detail
The vulnerability arises from Certifi's inclusion of root certificates from GLOBALTRUST, which were recognized until version 2024.7.4. These certificates are being removed due to long-standing compliance issues. The presence of these certificates can lead to potential security risks, as they may allow unauthorized access to secure communications, thereby compromising the integrity and confidentiality of data transmitted over SSL/TLS connections.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can manually remove the GLOBALTRUST certificates from their certificate store, but this is not a recommended long-term solution. It is best to update to the patched versions of the packages as soon as possible.
Conclusion
CVE-2024-39689 is a significant vulnerability affecting Python Pip and Certifi packages due to the inclusion of problematic root certificates. Users are strongly advised to update their packages to the latest versions to mitigate potential security risks. Regular monitoring and updating of open-source dependencies are crucial for maintaining application security.
See every vulnerability recorded for python-pip →
FAQ
CVE-2024-39689 is a vulnerability affecting the Python Pip and Certifi packages due to the inclusion of outdated root certificates from GLOBALTRUST.
This vulnerability can compromise the security of SSL/TLS communications in your application, potentially allowing unauthorized access to sensitive data.
You should update to the latest versions of these packages that have patched the vulnerability. Use the command 'pip install --upgrade pip certifi' to do so.
Yes, you can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for python-pip.
