The remote Fedora 40 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-075f626765 advisory.

    Update `uv` from 0.4.30 to 0.5.5. This is a significant update. Please see the following notes.

    ----

    By updating to a current release of `uv`, this update fixes     [CVE-2024-53899](https://nvd.nist.gov/vuln/detail/CVE-2024-53899), which was originally reported against     [`virtualenv`](https://pypi.org/project/virtualenv/) but which was also reproducible on `uv` 0.5.2 and     earlier. See [upstream issue #9424](https://github.com/astral-sh/uv/issues/9424) for more details.

    ----

    This update adds a default system-wide configuration file `/etc/uv/uv.toml` with settings specific to     Fedora. The RPM-packaged `uv` now deviates from the default configuration in two ways.

    First, we set `python-downloads` to `manual` in order to avoid unintended Python downloads. We suggest     using RPM-packaged (system) Pythons that benefit from distribution maintenance and integration. Use `uv     python install` to manually install managed Pythons.

    Second, we set `python-preference` to `system` instead of `managed`. Otherwise, any managed Python     would be used for `uv` operations where no particular Python is specified, even if the only available     managed Python were much older than the primary system Python.

    No choices can be appropriate for all users and applications. To restore the default behavior, comment out     settings in this file or override them in a configuration file with higher precedence, such as a user-     level configuration file. See https://docs.astral.sh/uv/configuration/files/ for details on the     interaction of project-, user-, and system-level configuration files.

    ----

    With 0.5.0, `uv` introduced several potentially breaking changes. The developers write that these are     changes that improve correctness and user experience, but could break some workflows. This release     contains those changes; many have been marked as breaking out of an abundance of caution. We expect most     users to be able to upgrade without making changes.

    - Use base executable to set virtualenv Python path
    - Use XDG (i.e. `~/.local/bin`) instead of the Cargo home directory in the installer
    - Discover and respect .python-version files in parent directories
    - Error when disallowed settings are defined in `uv.toml`
    - Implement PEP 440-compliant local version semantics
    - Treat the base Conda environment as a system environment
    - Do not allow pre-releases when the `!=` operator is used
    - Prefer `USERPROFILE` over `FOLDERID_Profile` when selecting a home directory on Windows
    - Improve interactions between color environment variables and CLI options
    - Make `allow-insecure-host` a global option
    - Only write `.python-version` files during `uv init` for workspace members if the version differs

    For detailed discussion of these changes, please see https://github.com/astral-sh/uv/releases/tag/0.5.0.

    For other fixes, enhancements, and changes in this update, please consult the following:

    - https://github.com/astral-sh/uv/releases/tag/0.5.1
    - https://github.com/astral-sh/uv/releases/tag/0.5.2
    - https://github.com/astral-sh/uv/releases/tag/0.5.3
    - https://github.com/astral-sh/uv/releases/tag/0.5.4
    - https://github.com/astral-sh/uv/releases/tag/0.5.5

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Detections

Analytics

Fedora 40 : uv (2024-075f626765)

critical Nessus Plugin ID 212151

Version 1.1