SUSE Strips Distrusted Certificate Authorities From Python Certifi Across Enterprise Linux Fleets
SUSE has published advisory SUSE-SU-2026:5130-1, rated important, for the python-certifi package shipped across its enterprise Linux estate. The update resolves one tracked vulnerability, CVE-2024-39689, and carries two additional security fixes recorded under bsc#1227519, bsc#1286261 and bsc#1287723. The affected footprint is broad: openSUSE Leap 15.4, the Public Cloud Module 15-SP4, the Python 3 Module 15-SP7, SUSE Linux Enterprise Server 15 SP4 through SP7 including the LTSS variants, SUSE Linux Enterprise Server for SAP Applications 15 SP4 to SP7, SUSE Linux Enterprise Desktop 15 SP7, the High Performance Computing ESPOS and LTSS editions for 15 SP4 and 15 SP5, and SUSE Manager Proxy, Retail Branch Server and Server 4.3. The fixed build is python311-certifi-2026.10.23-150400.12.10.1. SUSE scores CVE-2024-39689 at 3.7 on CVSS 3.1, while NVD rates the same issue 7.5 with an integrity-focused vector.
The certifi package exists for a single purpose: it supplies the bundle of trusted root certificates that Python applications, including anything built on the requests library, use to validate TLS connections. The flaw is therefore not a memory-safety bug or an injection path but a trust-store problem. CVE-2024-39689 covers the continued presence of root certificates belonging to the GLOBALTRUST authority, which this update removes from the bundle. Separately, SUSE has removed eMudhra intermediate certificates from the store following a reported compromise of that authority, tracked under bsc#1286261 and bsc#1287723. The advisory does not publish an exploitation chain or proof-of-concept detail, and no attack technique is described by the vendor. What the update does establish is that certificates chaining to these authorities would, until now, have been accepted as valid by Python code on affected systems, and the practical consequence of trusting a distrusted or compromised issuer is that a TLS certificate presented by an attacker-controlled endpoint could be validated without error.
The strategic weight of this advisory comes from where certifi sits rather than from how hard it is to abuse. Python tooling underpins a great deal of automation in enterprise and SAP environments, from package installers and cloud SDK calls to orchestration scripts and SUSE Manager infrastructure, and every one of those paths makes outbound TLS decisions using whatever root bundle certifi provides. A trust store that honours an issuer the wider ecosystem has already distrusted weakens the guarantee those connections depend on, and the eMudhra entries are being withdrawn specifically because of a reported compromise rather than a procedural failure, which places them in a more sensitive category. On current exploitation status, FIRST EPSS places CVE-2024-39689 at a 1.0 percent probability of exploitation in the next 30 days, and neither SUSE nor any authoritative source cited here reports exploitation in the wild. The residual exposure is also wider than the RPM suggests, because Python virtual environments, container images and application bundles frequently carry their own pip-installed copy of certifi that a distribution patch will not touch, leaving stale trust stores in place on hosts that otherwise appear fully updated.
Attack Surface
Server OS, Supply Chain (Third-party vendors), Infrastructure
Tactics
Defense Evasion, Credential Access, Resource Development
Techniques
- T1553.004 – Subvert Trust Controls: Install Root Certificate
- T1557 – Adversary-in-the-Middle
- T1588.004 – Obtain Capabilities: Digital Certificates
SuperPRO's Threat Countermeasures Procedures
- Install python311-certifi-2026.10.23-150400.12.10.1 on all affected hosts, which removes the GLOBALTRUST roots covered by CVE-2024-39689 and the compromised eMudhra intermediates recorded in bsc#1286261 and bsc#1287723.
- Apply the patch through the product-specific zypper command given in SUSE-SU-2026:5130-1, for example 'zypper in -t patch SUSE-SLE-Module-Python3-15-SP7-2026-5130' for the Python 3 Module 15-SP7, 'zypper in -t patch SUSE-SLE-Product-SLES-15-SP5-LTSS-2026-5130' for SLES 15 SP5 LTSS, and 'zypper in -t patch SUSE-2026-5130' for openSUSE Leap 15.4.
- Inventory SUSE Linux Enterprise Server 15 SP4 to SP7, SLES for SAP Applications 15 SP4 to SP7, SLE Desktop 15 SP7, HPC ESPOS and LTSS 15 SP4 and 15 SP5, Public Cloud Module 15-SP4 and SUSE Manager Proxy, Retail Branch Server and Server 4.3 to confirm which systems carry the noarch python311-certifi package.
- Run 'python3 -c "import certifi; print(certifi.__version__, certifi.where())"' inside virtual environments, container images and application bundles, because a pip-installed certifi older than 2026.10.23 keeps the distrusted roots even after the RPM is patched.
- Rebuild and redeploy container images that pin certifi in requirements files or lockfiles so the pinned version is raised to 2026.10.23 or later, rather than relying on the host RPM to cover containerised Python workloads.
- Search TLS inspection, proxy and application logs for certificate chains terminating at GLOBALTRUST or eMudhra issuers and treat any such connection from a Python-based service or automation account as requiring investigation.
- Cross-check internal PKI and certificate inventories for any server or client certificate issued under eMudhra intermediates and schedule reissuance under a trusted authority, since those intermediates are being withdrawn on the basis of a reported compromise.
