PyPI/uv: critical
uv's bundled CA store trusts an emSign root whose intermediate CA keys are compromised
Action: Upgrade uv to 0.13.4 or later.
pip install uv==0.13.4Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.13.4 | - |
Fixed versions
| 0.13.4 |
Sources
- osv: GHSA-hq85-5cpj-mr62
- https://github.com/astral-sh/uv/security/advisories/GHSA-hq85-5cpj-mr62
- https://github.com/certifi/python-certifi/security/advisories/GHSA-6q48-6c7w-9gw2
- https://emudhra.we-have-a-problem.com
- https://github.com/astral-sh/uv
- https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/0R3XLJL6FuE/m/0XofdebrAAAJ
published · modified · JSON