Fedora 42 : python-uv-build / ruff / rust-get-size-derive2 / rust-get-size2 / etc (2025-e60a4ba4d7)

The remote Fedora 42 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2025-e60a4ba4d7 advisory. uv / python-uv-build 0.9.7 https://github.com/astral-sh/uv/releases/tag/0.9.7 0.9.6 This release contains an upgrade to Astral's fork of asynczip, which...

Fedora 41 : python-uv-build / ruff / rust-get-size-derive2 / rust-get-size2 / etc (2025-00e5b3d89c)

The remote Fedora 41 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2025-00e5b3d89c advisory. uv / python-uv-build 0.9.7 https://github.com/astral-sh/uv/releases/tag/0.9.7 0.9.6 This release contains an upgrade to Astral's fork of asynczip, which...

auto-wasi (=0.1.0), candid-extractor (>=0.1.0 <=0.1.2) +105 more potentially affected by CVE-2025-64345 via wasmtime (>=0.10.0 <=1.0.2)

wasmtime CARGO version =0.10.0, =0.1.0, =0.1.0, =0.1.0, =0.1.1, =0.5.3-0, =0.4.0, =0.4.0, =0.0.0, =0.5.0, =0.0.1-alpha, =0.40.1, =0.45.0, =0.1.0, =0.3.0 and more Source cves: CVE-2025-64345 Source advisory: OSV:GHSA-HC7M-R6V8-HG9Q...

auto-wasi (=0.1.0), candid-extractor (>=0.1.0 <=0.1.2) +105 more potentially affected by CVE-2025-64345 via wasmtime (>=0.10.0 <=1.0.2)

wasmtime CARGO version =0.10.0, =0.1.0, =0.1.0, =0.1.0, =0.1.1, =0.5.3-0, =0.4.0, =0.4.0, =0.0.0, =0.5.0, =0.0.1-alpha, =0.40.1, =0.45.0, =0.1.0, =0.3.0 and more Source cves: CVE-2025-64345 Source advisory: OSV:RUSTSEC-2025-0118...

tandem_http_server is unmaintained

The tandem crates in https://github.com/sine-fdn are no longer maintained by the SINE Foundation. The repository has been archived. Recommended alternative We are continuing our work on SMPC by implementing our secure multi-party computation engine Polytune...

tandem_http_client is unmaintained

The tandem crates in https://github.com/sine-fdn are no longer maintained by the SINE Foundation. The repository has been archived. Recommended alternative We are continuing our work on SMPC by implementing our secure multi-party computation engine Polytune...

RUSTSEC-2025-0117 tandem is unmaintained

The tandem crates in https://github.com/sine-fdn are no longer maintained by the SINE Foundation. The repository has been archived. Recommended alternative We are continuing our work on SMPC by implementing our secure multi-party computation engine Polytune...

RUSTSEC-2025-0115 tandem_http_server is unmaintained

The tandem crates in https://github.com/sine-fdn are no longer maintained by the SINE Foundation. The repository has been archived. Recommended alternative We are continuing our work on SMPC by implementing our secure multi-party computation engine Polytune...

card-backend-scdc (>=0.4.0 <=0.5.0), cfs_openpgp (=0.1.0) +43 more potentially affected by CVE-2025-67897 via sequoia-openpgp (>=0.11.0 <=1.22.0)

sequoia-openpgp CARGO version =0.11.0, =0.4.0, =0.0.1, =0.5.0, =0.3.0, =0.12.0, =0.1.0, =0.10.1, =0.10.1, =0.0.1, =0.0.1, =0.2.2 and more Source cves: CVE-2025-67897 Source advisory: OSV:RUSTSEC-2025-0136...

[SECURITY] Fedora 43 Update: maturin-1.9.6-1.fc43

Build and publish crates with pyo3, rust-cpython and cffi bindings as well as rust binaries as python packages...

alpha-g-analysis (=0.1.0), apecrunch (>=0.0.1 <=0.0.3) +179 more potentially affected by unknown CVE via ncurses (>=5.101.0 <=6.0.1)

ncurses CARGO version =5.101.0, =0.0.1, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.8.7 - btui =0.6.5 and more Source cves: unknown CVE Source advisory: OSV:GHSA-X77X-7MMH-CXV3...

orx-concurrent-bag (>=1.0.0 <=1.16.0), orx-concurrent-iter (>=1.0.0 <=1.22.1) +9 more potentially affected by unknown CVE via orx-pinned-vec (>=0.1.1 <=2.12.0)

orx-pinned-vec CARGO version =0.1.1, =1.0.0, =1.0.0, =1.0.0, =0.1.0, =0.1.0, =0.6.0, =0.1.0, =1.0.0, =1.0.0, =1.0.0, =0.6.0, =2.14.0 Source cves: unknown CVE Source advisory: OSV:GHSA-H5J3-CRG5-8JQM...

apple-opensource-downloader (=0.1.0), async_bagit (>=0.1.0 <=0.2.0) +11 more potentially affected by CVE-2025-62518 via tokio-tar (=0.3.1)

tokio-tar CARGO version =0.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on tokio-tar and may be impacted: - apple-opensource-downloader =0.1.0 - asyncbagit =0.1.0, =0.1.8, =0.8.0, =0.2.0, =0.1.0, =0.2.5, =0.4.0, =0.6.0, =0.12.0, =0.1.0,...

alpha-g-analysis (=0.1.0), apecrunch (>=0.0.1 <=0.0.3) +179 more potentially affected by unknown CVE via ncurses (>=5.101.0 <=6.0.1)

ncurses CARGO version =5.101.0, =0.0.1, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.8.7 - btui =0.6.5 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2025-0108...

apple-opensource-downloader (=0.1.0), async_bagit (>=0.1.0 <=0.2.0) +11 more potentially affected by CVE-2025-62518 via tokio-tar (=0.3.1)

tokio-tar CARGO version =0.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on tokio-tar and may be impacted: - apple-opensource-downloader =0.1.0 - asyncbagit =0.1.0, =0.1.8, =0.8.0, =0.2.0, =0.1.0, =0.2.5, =0.4.0, =0.6.0, =0.12.0, =0.1.0,...

CuPs (>=0.0.0 <=0.0.5), IF (=0.0.0) +110 more potentially affected by unknown CVE via unic-ucd-segment (>=0.7.0 <=0.9.0)

unic-ucd-segment CARGO version =0.7.0, =0.0.0, =1.11.3, =0.3.0, =0.1.0, =0.5.0, =0.5.0, =0.3.0, =1.0.0, =0.1.0, =0.0.4, =0.1.0, =0.2.6, =0.0.15, =0.2.11 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2025-0104...

CuPs (>=0.0.0 <=0.0.5), IF (=0.0.0) +19 more potentially affected by unknown CVE via unic-ucd-block (>=0.8.0 <=0.9.0)

unic-ucd-block CARGO version =0.8.0, =0.0.0, =1.11.3, =0.3.0, =0.3.0, =0.0.102, =0.0.7, =0.0.1, =1.0.0, =0.0.0, =0.1.0, =1.1.1, =2.0.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2025-0099...

Druid_task1 (=0.1.0), audio-processor-analysis (>=0.1.0-alpha.4 <=2.4.0) +72 more potentially affected by unknown CVE via unic-bidi (>=0.1.0 <=0.9.0)

unic-bidi CARGO version =0.1.0, =0.1.0-alpha.4, =0.4.0, =0.7.0, =0.4.0, =0.7.0, =0.2.0, =0.2.3 - frui =0.0.1 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2025-0096...

CuPs (>=0.0.0 <=0.0.5), Druid_task1 (=0.1.0) +318 more potentially affected by unknown CVE via unic-ucd-version (>=0.7.0 <=0.9.0)

unic-ucd-version CARGO version =0.7.0, =0.0.0, =1.11.3, =0.1.2, =0.1.0, =0.3.0, =0.1.0, =0.5.0, =0.5.0, =0.1.0-alpha.4, =2.4.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2025-0098...

bootstring (=0.1.0), deltachat_message_parser (>=0.3.0 <=0.14.1) +8 more potentially affected by unknown CVE via unic-idna-punycode (>=0.1.1 <=0.9.0)

unic-idna-punycode CARGO version =0.1.1, =0.3.0, =0.3.0, =0.2.4-beta, =0.3.0, =0.1.0, =0.1.0, =0.5.0, =0.7.0, =0.1.1, =0.9.0 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2025-0088...