Detections
Analytics

Fedora 40 : uv (2024-075f626765)

critical Nessus Plugin ID 212151

Language:

Synopsis

The remote Fedora host is missing one or more security updates.

Description

The remote Fedora 40 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-075f626765 advisory.

 Update `uv` from 0.4.30 to 0.5.5. This is a significant update. Please see the following notes.

 ----

 By updating to a current release of `uv`, this update fixes [CVE-2024-53899](https://nvd.nist.gov/vuln/detail/CVE-2024-53899), which was originally reported against [`virtualenv`](https://pypi.org/project/virtualenv/) but which was also reproducible on `uv` 0.5.2 and earlier. See [upstream issue #9424](https://github.com/astral-sh/uv/issues/9424) for more details.

 ----

 This update adds a default system-wide configuration file `/etc/uv/uv.toml` with settings specific to Fedora. The RPM-packaged `uv` now deviates from the default configuration in two ways.

 First, we set `python-downloads` to `manual` in order to avoid unintended Python downloads. We suggest using RPM-packaged (system) Pythons that benefit from distribution maintenance and integration. Use `uv python install` to manually install managed Pythons.

 Second, we set `python-preference` to `system` instead of `managed`. Otherwise, any managed Python would be used for `uv` operations where no particular Python is specified, even if the only available managed Python were much older than the primary system Python.

 No choices can be appropriate for all users and applications. To restore the default behavior, comment out settings in this file or override them in a configuration file with higher precedence, such as a user- level configuration file. See https://docs.astral.sh/uv/configuration/files/ for details on the interaction of project-, user-, and system-level configuration files.

 ----

 With 0.5.0, `uv` introduced several potentially breaking changes. The developers write that these are changes that improve correctness and user experience, but could break some workflows. This release contains those changes; many have been marked as breaking out of an abundance of caution. We expect most users to be able to upgrade without making changes.

 - Use base executable to set virtualenv Python path
 - Use XDG (i.e. `~/.local/bin`) instead of the Cargo home directory in the installer
 - Discover and respect .python-version files in parent directories
 - Error when disallowed settings are defined in `uv.toml`
 - Implement PEP 440-compliant local version semantics
 - Treat the base Conda environment as a system environment
 - Do not allow pre-releases when the `!=` operator is used
 - Prefer `USERPROFILE` over `FOLDERID_Profile` when selecting a home directory on Windows
 - Improve interactions between color environment variables and CLI options
 - Make `allow-insecure-host` a global option
 - Only write `.python-version` files during `uv init` for workspace members if the version differs

 For detailed discussion of these changes, please see https://github.com/astral-sh/uv/releases/tag/0.5.0.

 For other fixes, enhancements, and changes in this update, please consult the following:

 - https://github.com/astral-sh/uv/releases/tag/0.5.1
 - https://github.com/astral-sh/uv/releases/tag/0.5.2
 - https://github.com/astral-sh/uv/releases/tag/0.5.3
 - https://github.com/astral-sh/uv/releases/tag/0.5.4
 - https://github.com/astral-sh/uv/releases/tag/0.5.5

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected uv package.

See Also

https://bodhi.fedoraproject.org/updates/FEDORA-2024-075f626765

Plugin Details

Severity: Critical

ID: 212151

File Name: fedora_2024-075f626765.nasl

Version: 1.1

Type: local

Agent: unix

Published: 12/7/2024

Updated: 12/7/2024

Supported Sensors: Agentless Assessment, Continuous Assessment, Frictionless Assessment Agent, Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2024-53899

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:fedoraproject:fedora:40, p-cpe:/a:fedoraproject:fedora:uv

Required KB Items: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 11/27/2024

Vulnerability Publication Date: 11/24/2024

Reference Information

CVE: CVE-2024-53899