Exiftool: Certifi removes GLOBALTRUST root certificate (CVE-2024-39689)
Description
Certifi, a curated collection of root certificates used for SSL/TLS verification, removed GLOBALTRUST root certificates starting in version 2024.7.4. These certificates were previously recognized from version 2021.5.30 up to but not including 2024.7.4. The removal follows an investigation revealing long-standing compliance issues with GLOBALTRUST's root certificates, which are also being removed from Mozilla's trust store.
CVSS v3.1
Score 7.5high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Certifi versions from 2021.5.30 through prior to 2024.7.4 included root certificates from GLOBALTRUST. Due to an investigation identifying unresolved compliance issues, Certifi 2024.7.4 removes these GLOBALTRUST root certificates from its root store. This change aligns with Mozilla's removal of GLOBALTRUST root certificates from its trust store. The vulnerability is identified as CVE-2024-39689 and affects Exiftool versions >=13.10 that rely on Certifi for SSL certificate validation.
Potential Impact
The removal of GLOBALTRUST root certificates means that SSL/TLS connections validated against these roots will no longer be trusted by Certifi starting from version 2024.7.4. This could lead to failures in SSL/TLS verification for services or hosts using GLOBALTRUST certificates, potentially causing service disruptions or denial of trust. The integrity of SSL validation is maintained by removing certificates with compliance issues, preventing potential misuse or trust of compromised roots.
Mitigation Recommendations
A fix is available by upgrading Certifi to version 2024.7.4 or later, which removes the problematic GLOBALTRUST root certificates. Users of Exiftool and other dependent software should update to versions that include this Certifi update. No additional action is required beyond applying this update, as the vendor has officially remediated the issue.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- BREW-exiftool-CVE-2024-39689
- Osv Schema Version
- 1.7.3
- Ecosystems
- ["Homebrew"]
- Cvss Version
- 3.1
Patch Information
Threat ID: 6ac96e5a2cdf04f65689a813
Added to database: 10/09/2026, 22:44:42 UTC
Last enriched: 10/09/2026, 22:52:50 UTC
Last updated: 10/09/2026, 22:52:50 UTC
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.