Improper Certificate Validation in python-certifi - CVE-2024-39689

Vulnerability identifier: #VU96731

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-39689

CWE-ID: CWE-295

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to modify data on the system.

The vulnerability exists due to Certifi python-certifi provide weaker than expected security, caused by the use of GLOBALTRUST root certificate. A remote attacker can trigger the vulnerability to launch further attacks on the system.

python-certifi
Guardium Data Security Center (GDSC)
IBM Application Suite - IBM Asset Data Dictionary Component
QRadar App SDK
Cloud Pak for Network Automation
Security QRadar EDR
IBM Cloud Pak for Watson AIOps
Storage Resource Manager
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data
SOAR QRadar Plugin App
Db2 Big SQL
Maximo Application Suite - IoT Component
Maximo Application Suite - Edge Data Collector
Maximo Application Suite - Monitor Component
Storage Protect Plus File Systems Agent
IBM Netezza for Cloud Pak for Data
CP4BA - Filenet Content Manager
Business Automation Insights
IBM InfoSphere Information Server
Aws-iam-authenticator
IBM Maximo Application Suite - AI Broker
IBM Observability with Instana
IBM Watson Knowledge Catalog in Cloud Pak for Data
IBM Process Mining
IBM Cloud Pak for Data System
Qradar Advisor
IBM Fusion HCI
IBM Security Guardium Insights
IBM Cloud Object Storage Systems
QRadar User Behavior Analytics
Splunk Add-on for Google Cloud Platform
IBM Decision Optimization for Cloud Pak for Data
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
App Connect Enterprise Certified Container
IBM Watson Assistant for IBM Cloud Pak for Data
Splunk Add-on for Amazon Web Services
IBM Maximo Application Suite
IBM Cloud Pak for Business Automation
IBM Business Automation Workflow
SmartFabric Storage Software
PowerScale OneFS
QRadar Suite
openEuler
Anolis OS
Fedora
watsonx.data
Splunk Add-on for Cisco Meraki
Splunk Add-on for Office 365
Dell EMC Storage Monitoring and Reporting (SMR)
IBM Storage Scale System
IBM FileNet Content Manager
IBM Qradar SIEM
ca-certificates
mingw-python-certifi
python3-certifi-doc
python3-certifi

Install updates from vendor's website.

python-certifi - update to 2024.07.04
Aws-iam-authenticator - update to 0.6.24
IBM Maximo Application Suite - AI Broker - update to 1.0.1
IBM Observability with Instana - update to 1.0.309
SmartFabric Storage Software - update to 1.4.3
QRadar Suite - update to 1.10.25.0
Guardium Data Security Center (GDSC) - update to 3.8.5
IBM Watson Knowledge Catalog in Cloud Pak for Data - addressed in versions 4.8.8, 4.8.9, 5.1.1, 5.1.2, 5.1.3
IBM Application Suite - IBM Asset Data Dictionary Component - update to 1.1.12
IBM Process Mining - update to 1.15.0 IF001
watsonx.data - update to 2.0.2
IBM Cloud Pak for Data System - update to 2.0.2.1.IF2
Splunk Add-on for Cisco Meraki - update to 2.2.0
QRadar App SDK - update to 2.2.2
Qradar Advisor - update to 2.6.6
Cloud Pak for Network Automation - update to 2.7.5
IBM Fusion HCI - update to 2.9.0
IBM Security Guardium Insights - update to 3.4.1
Security QRadar EDR - update to 3.12.11
IBM Cloud Object Storage Systems - addressed in versions 3.18.0.75, 3.18.4.45
QRadar User Behavior Analytics - update to 4.1.17
Splunk Add-on for Office 365 - update to 4.5.2
Splunk Add-on for Google Cloud Platform - update to 4.7.0
IBM Cloud Pak for Watson AIOps - update to 4.8.0
IBM Decision Optimization for Cloud Pak for Data - update to 4.8
IBM Watson Discovery for IBM Cloud Pak for Data - addressed in versions 4.8.7, 5.0.3
Dell EMC Storage Monitoring and Reporting (SMR) - update to 5.0.2.2
Storage Resource Manager - update to 5.0.2.2
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 5.0.3
App Connect Enterprise Certified Container - addressed in versions 5.0.19, 12.2.0
IBM Watson Assistant for IBM Cloud Pak for Data - update to 5.1
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data - update to 5.1.1
IBM Storage Scale System - update to 5.1.9.6
SOAR QRadar Plugin App - update to 5.5.0
IBM FileNet Content Manager - addressed in versions 5.5.8.0 IF008, 5.5.12.0 IF003, 5.6.0.0 IF001
IBM Qradar SIEM - update to 7.5.0 Update Pack 10 IF01
Splunk Add-on for Amazon Web Services - update to 7.7.0
Db2 Big SQL - update to 7.7.3
Maximo Application Suite - IoT Component - addressed in versions 8.7.21, 8.8.17, 9.0.7
Maximo Application Suite - Edge Data Collector - addressed in versions 8.10.12, 8.11.10, 9.0.1
Maximo Application Suite - Monitor Component - addressed in versions 8.10.15, 8.11.13, 9.0.5
IBM Maximo Application Suite - addressed in versions 8.10.17, 8.11.14, 9.0.2
PowerScale OneFS - addressed in versions 9.5.1.3, 9.7.1.5, 9.7.1.8, 9.10.0.0, 9.10.1.2
Storage Protect Plus File Systems Agent - update to 10.1.16.3
IBM Netezza for Cloud Pak for Data - update to 11.2.3.3
IBM Cloud Pak for Business Automation - addressed in versions 21.0.3-IF035, 24.0.0-IF001
CP4BA - Filenet Content Manager - addressed in versions 21.0.3 IF36, 24.0.0 IF1
IBM Business Automation Workflow - update to 24.0.0-IF001
Business Automation Insights - update to 24.0.0.0.1
ca-certificates - update to 2023.2.60-5
mingw-python-certifi - update to 2024.7.4-1.fc40
python3-certifi-doc - update to 2024.08.30-1
python3-certifi - update to 2024.08.30-1

• https://github.com/certifi/python-certifi/security/advisories/GHSA-248v-346w-9cwc
• https://github.com/certifi/python-certifi/commit/bd8153872e9c6fc98f4023df9c2deaffea2fa463
• https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/XpknYMPO8dI

• Improper certificate validation in Certifi python-certifi
• Multiple vulnerabilities in IBM Cloud Pak for Network Automation
• Fedora 40 update for mingw-python-certifi
• Improper certificate validation in IBM Security QRadar EDR
• Multiple vulnerabilities in IBM QRadar Suite software
• Improper certificate validation in IBM watsonx.data
• Improper certificate validation in IBM InfoSphere Information Server
• Improper certificate validation in IBM Decision Optimization for Cloud Pak for Data
• Multiple vulnerabilities in IBM App Connect Enterprise Certified Container
• Multiple vulnerabilities in IBM Business Automation Workflow
• Multiple vulnerabilities in IBM Cloud Pak for Business Automation
• Multiple vulnerabilities in IBM Process Mining
• Improper certificate validation in IBM Maximo Application Suite - AI Broker
• Multiple vulnerabilities in IBM Cloud Object System
• Improper certificate validation in IBM Maximo Application Suite
• Improper certificate validation in IBM Watson Discovery
• IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data update for Certifi python-certifi
• Splunk Add-on for Amazon Web Services update for third-party components
• IBM Asset Data Dictionary Component update for Certifi python-certifi
• Multiple vulnerabilities in IBM Storage Protect Plus File Systems Agent
• Multiple vulnerabilities in IBM Security Guardium Insights
• IBM Storage Scale update for certifi-2024.2.2-py3-none-any.whl
• aws-iam-authenticator update for python-certifi
• Splunk Add-on for Office 365 update for third-party components
• Multiple vulnerabilities in IBM SOAR QRadar Plugin App
• Multiple vulnerabilities in IBM Business Automation Insights
• Multiple vulnerabilities in Splunk Add-on for Cisco Meraki
• Multiple vulnerabilities in Splunk Add-on for Google Cloud Platform
• Multiple vulnerabilities in IBM QRadar App SDK
• IBM Edge Data Collector update for Certifi python-certifi
• Multiple vulnerabilities in IBM QRadar SIEM
• IBM FileNet Content Manager in Certifi python-certifi
• Multiple vulnerabilities in IBM QRadar User Behavior Analytics
• Multiple vulnerabilities in IBM Cloud Pak for AIOps
• IBM Watson Assistant for IBM Cloud Pak for Data update for Certifi python-certifi
• Multiple vulnerabilities in IBM Fusion HCI Installer
• IBM Big SQL on IBM Cloud Pak for Data update for Certifi python-certifi
• Multiple vulnerabilities in IBM Netezza for Cloud Pak for Data (on Cloud)
• IBM Maximo Application Suite - Monitor Component update for Certifi python-certifi
• IBM watsonx Orchestrate Cartridge for IBM Cloud Pak for Data update for Certifi
• Multiple vulnerabilities in QRadar Advisor With Watson for IBM QRadar SIEM
• Dell SmartFabric Storage Software update for third-party components
• Multiple vulnerabilities in IBM Maximo Application Suite - IoT Component
• IBM Cloud Pak for Data System 2.0 update for Certifi
• Multiple vulnerabilities in Dell PowerScale OneFS
• Multiple vulnerabilities in Dell Storage Resource Manager (SRM) and Dell Storage Monitoring and Reporting (SMR)
• Multiple vulnerabilities in IBM Watson Knowledge Catalog
• Multiple vulnerabilities in Dell PowerScale OneFS
• Anolis OS update for python-certifi
• Multiple vulnerabilities in IBM Guardium Data Security Center
• Multiple vulnerabilities in IBM Observability with Instana
• openEuler update for ca-certificates