Attestkeep
Sprache: Deutsch
Loslegen

Schwachstellen / GHSA-hq85-5cpj-mr62

kritisch

GHSA-hq85-5cpj-mr62

uv's bundled CA store trusts an emSign root whose intermediate CA keys are compromised

Veröffentlicht Geändert
In der Trivy Database seit spätestens 24. Okt. 2026, 07:11 UTCWann der Eintrag vor diesem Build hinzukam, ist nicht erfasst.

Einstufung nach Quelle

GHSA9.1CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Trivys eigenes Label ist CRITICAL. Kritisch laut GHSA.

Beschreibung

By default, uv verifies TLS connections against a vendored copy of the `webpki-root-certs` bundle. Versions before 0.13.4 include the `emSign ECC Root CA - G3` root. Eight eMudhra intermediate CA certificates that chain to that root have compromised private keys, and the CA has revoked them. An attacker with one of the compromised keys can issue certificates that uv accepts for any hostname, and can be used to issue certificates to enable MITM attacks. uv 0.13.4 removes the root from its vendored bundle, following `webpki-root-certs` 1.0.10. Upgrade to 0.13.4 or later.

Betroffene Pakete und behobene Versionen

QuellePaketBehoben in
pip::GitHub Security Advisory pipuv0.13.4
rapidfort alpine 3.20uvkein Fix angegeben
rapidfort alpine 3.21uvkein Fix angegeben
rapidfort alpine 3.22uvkein Fix angegeben
rapidfort alpine 3.23uvkein Fix angegeben
rapidfort alpine 3.24uvkein Fix angegeben
rapidfort fedora 43python3-uv, uv0.13.5-2.fc43
rapidfort Oracle Linux 10python3-uv, uv0.13.5-2.el10_4
Alle 10 Einträge aus 8 Quellen zeigen
QuellePaketBehoben in
pip::GitHub Security Advisory pipuv0.13.4
rapidfort alpine 3.20uvkein Fix angegeben
rapidfort alpine 3.21uvkein Fix angegeben
rapidfort alpine 3.22uvkein Fix angegeben
rapidfort alpine 3.23uvkein Fix angegeben
rapidfort alpine 3.24uvkein Fix angegeben
rapidfort fedora 43python3-uv0.13.5-2.fc43
rapidfort fedora 43uv0.13.5-2.fc43
rapidfort Oracle Linux 10python3-uv0.13.5-2.el10_4
rapidfort Oracle Linux 10uv0.13.5-2.el10_4

Referenzen

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.