Attestkeep
Langue : Français
S'inscrire

Vulnérabilités / GHSA-hq85-5cpj-mr62

critique

GHSA-hq85-5cpj-mr62

uv's bundled CA store trusts an emSign root whose intermediate CA keys are compromised

Publiée Modifiée
Dans la Trivy database depuis au moins le 24 oct. 2026, 07:11 UTCLa date d'entrée avant ce build n'est pas enregistrée.

Sévérité par source

GHSA9.1CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Le label propre à Trivy est CRITICAL. Critique selon GHSA.

Description

By default, uv verifies TLS connections against a vendored copy of the `webpki-root-certs` bundle. Versions before 0.13.4 include the `emSign ECC Root CA - G3` root. Eight eMudhra intermediate CA certificates that chain to that root have compromised private keys, and the CA has revoked them. An attacker with one of the compromised keys can issue certificates that uv accepts for any hostname, and can be used to issue certificates to enable MITM attacks. uv 0.13.4 removes the root from its vendored bundle, following `webpki-root-certs` 1.0.10. Upgrade to 0.13.4 or later.

Paquets affectés et versions corrigées

SourcePaquetCorrigé en
pip::GitHub Security Advisory pipuv0.13.4
rapidfort alpine 3.20uvpas de correctif indiqué
rapidfort alpine 3.21uvpas de correctif indiqué
rapidfort alpine 3.22uvpas de correctif indiqué
rapidfort alpine 3.23uvpas de correctif indiqué
rapidfort alpine 3.24uvpas de correctif indiqué
rapidfort fedora 43python3-uv, uv0.13.5-2.fc43
rapidfort Oracle Linux 10python3-uv, uv0.13.5-2.el10_4
Afficher les 10 entrées de 8 sources
SourcePaquetCorrigé en
pip::GitHub Security Advisory pipuv0.13.4
rapidfort alpine 3.20uvpas de correctif indiqué
rapidfort alpine 3.21uvpas de correctif indiqué
rapidfort alpine 3.22uvpas de correctif indiqué
rapidfort alpine 3.23uvpas de correctif indiqué
rapidfort alpine 3.24uvpas de correctif indiqué
rapidfort fedora 43python3-uv0.13.5-2.fc43
rapidfort fedora 43uv0.13.5-2.fc43
rapidfort Oracle Linux 10python3-uv0.13.5-2.el10_4
rapidfort Oracle Linux 10uv0.13.5-2.el10_4

Références

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.