Alerts This Week
Warning Icon 1 535
Alerts This Week
Warning Icon 1 535

Fedora 42: ruff 0.14.2 Important Parser Fix CVE-2025-62518 Advisory

fedora
Calendar Grey November 3, 2025
Dist Fedora Esm H88
A security advisory for Fedora 42 regarding ruff 0.14.2 that addresses a critical parser issue. Immediate action is needed.
uv 0.9.5 https://github.com/astral-sh/uv/blob/0.9.5/CHANGELOG.md Since uv was built with astral-tokio-tar 0.5.6, this is a security fix for CVE-2025-62518

Summary

An extremely fast Python linter and code formatter, written in Rust.

Ruff aims to be orders of magnitude faster than alternative tools while

integrating more functionality behind a single, common interface.

Ruff can be used to replace Flake8 (plus dozens of plugins), Black, isort,

pydocstyle, pyupgrade, autoflake, and more, all while executing tens or

hundreds of times faster than any individual tool.

Update Information:

uv 0.9.5 https://github.com/astral-sh/uv/blob/0.9.5/CHANGELOG.md Since uv was built with astral-tokio-tar 0.5.6, this is a security fix for CVE-2025-62518. ruff 0.14.2 https://github.com/astral-sh/ruff/blob/0.14.2/CHANGELOG.md rust-astral-tokio-tar 0.5.6 Fixed a parser desynchronization vulnerability when reading tar archives that contain mismatched size information in PAX/ustar headers. This vulnerability is being tracked as GHSA-j5gw-2vrg-8fgx and CVE-2025-62518. Initial package for python-uv-build in Fedora 42 Initial packages for a number of new dependencies for ruff and uv Update rust-tikv-jemallocator and rust-tikv-jemalloc-sys to 0.6.1 Update openapi-python-client to 0.26.2 and patch it to allow ruff 0.14

Topics%20covered

Topics Covered

security advisory denial of service fedora important parser fix Python linter

Change Log

* Thu Oct 23 2025 Benjamin A. Beasley - 0.14.2-1 - Update to version 0.14.2; Fixes RHBZ#2406135 * Wed Oct 22 2025 Benjamin A. Beasley - 0.14.1-2 - Double _smp_tasksize_proc again - Builds for F41 were failing consistently on s390x * Mon Oct 20 2025 Benjamin A. Beasley - 0.14.1-1 - Update to 0.14.1 (close RHBZ#2360699) * Mon Oct 20 2025 Benjamin A. Beasley - 0.14.0-2 - Skip salsa\u2019s execute_cancellation tests on all architectures * Mon Oct 20 2025 Benjamin A. Beasley - 0.14.0-1 - Update to 0.14.0 * Mon Oct 20 2025 Benjamin A. Beasley - 0.13.3-1 - Update to 0.13.3 * Mon Oct 20 2025 Benjamin A. Beasley - 0.13.2-1 - Update to 0.13.2 * Thu Oct 16 2025 Gordon Messmer - 0.12.1-2 - Use rpm's native resource tunable to limit parallelism. * Wed Sep 24 2025 Benjamin A. Beasley - 0.12.1-1 - Update to 0.12.1 * Wed Sep 24 2025 Benjamin A. Beasley - 0.12.0-1 - Update to 0.12.0

References


[ 1 ] Bug #2360699 - ruff-0.14.1 is available https://bugzilla.redhat.com/show_bug.cgi?id=2360699 [ 2 ] Bug #2402441 - rust-reqsign-core-2.0.0 is available https://bugzilla.redhat.com/show_bug.cgi?id=2402441 [ 3 ] Bug #2402442 - rust-reqsign-command-execute-tokio-2.0.0 is available https://bugzilla.redhat.com/show_bug.cgi?id=2402442 [ 4 ] Bug #2402443 - rust-reqsign-http-send-reqwest-2.0.0 is available https://bugzilla.redhat.com/show_bug.cgi?id=2402443 [ 5 ] Bug #2402881 - python-uv-build-0.9.5 is available https://bugzilla.redhat.com/show_bug.cgi?id=2402881 [ 6 ] Bug #2402923 - uv-0.9.5 is available https://bugzilla.redhat.com/show_bug.cgi?id=2402923 [ 7 ] Bug #2405474 - CVE-2025-62518 rust-astral-tokio-tar: astral-tokio-tar Vulnerable to PAX Header Desynchronization [fedora-42] https://bugzilla.redhat.com/show_bug.cgi?id=2405474 [ 8 ] Bug #2405476 - CVE-2025-62518 uv: astral-tokio-tar Vulnerable to PAX Header...

Read the Full Advisory

Update Instructions

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2025-a77c1f005b' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label

Severity
important
Lowest
Low
Medium
High
Critical

Name: ruff
Product: Fedora 42
Version: 0.14.2
Release: 1.fc42
URL: https://github.com/astral-sh/ruff
Summary: Extremely fast Python linter and code formatter

Topics%20covered

Topics Covered

security advisory denial of service fedora important parser fix Python linter

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Related News

Your message here