Stay Secure with the Latest Linux Advisories

security advisoryupdateFedora

Fedora 40: FEDORA-2024-075f626765 critical: uv command injection fix

An extremely fast Python package installer and resolver, written in Rust. Designed as a drop-in replacement for common pip and pip-tools workflows. Highlights: • ⚖️ Drop-in replacement for common pip, pip-tools, and virtualenv commands. 10-100x faster than pip and pip-tools (pip-compile and pip-sync). . -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2024-075f626765 2024-12-07 06:06:15.606807+00:00 -------------------------------------------------------------------------------- Name : uv Product : Fedora 40 Version : 0.5.5 Release : 2.fc40 URL : https://github.com/astral-sh/uv Summary : An extremely fast Python package installer and resolver, written in Rust Description : An extremely fast Python package installer and resolver, written in Rust. Designed as a drop-in replacement for common pip and pip-tools workflows. Highlights: Drop-in replacement for common pip, pip-tools, and virtualenv commands. 10-100x faster than pip and pip-tools (pip-compile and pip-sync). Disk-space efficient, with a global cache for dependency deduplication. Installable via curl, pip, pipx, etc. uv is a static binary that can be installed without Rust or Python. Tested at-scale against the top 10,000 PyPI packages. Support for macOS, Linux, and Windows. Advanced features such as dependency version overrides and alternative resolution strategies. Best-in-class error messages with a conflict-tracking resolver. Support for a wide range of advanced pip features, including editable installs, Git dependencies, direct URL dependencies, local dependencies, constraints, source distributions, HTML and JSON indexes, and more. -------------------------------------------------------------------------------- Update Information: Update uv from 0.4.30 to 0.5.5. This is a significant update. Please see the following notes. By updating to a current release ofuv, this update fixes CVE-2024-53899, which was originally reported against virtualenv but which was also reproducible on uv 0.5.2 and earlier. See upstream issue #9424 for more details. This update adds a default system-wide configuration file /etc/uv/uv.toml with settings specific to Fedora. The RPM-packaged uv now deviates from the default configuration in two ways. First, we set "python-downloads" to "manual" in order to avoid unintended Python downloads. We suggest using RPM-packaged (system) Pythons that benefit from distribution maintenance and integration. Use uv python install to manually install managed Pythons. Second, we set "python-preference" to "system" instead of "managed". Otherwise, any managed Python would be used for uv operations where no particular Python is specified, even if the only available managed Python were much older than the primary system Python. No choices can be appropriate for all users and applications. To restore the default behavior, comment out settings in this file or override them in a configuration file with higher precedence, such as a user-level configuration file. See https://docs.astral.sh/uv/configuration/files/ for details on the interaction of project-, user-, and system-level configuration files. With 0.5.0, uv introduced several potentially breaking changes. The developers write that these are “changes that improve correctness and user experience, but could break some workflows. This release contains those changes; many have been marked as breaking out of an abundance of caution. We expect most users to be able to upgrade without making changes.” Use base executable to set virtualenv Python path Use XDG (i.e. ~/.local/bin) instead of the Cargo home directory in the installer Discover and respect .python-version files in parent directories Error when disallowed settings are defined in uv.toml Implement PEP 440-compliant local version semantics Treat the base Conda environment as a system environment Do not allowpre-releases when the != operator is used Prefer USERPROFILE over FOLDERID_Profile when selecting a home directory on Windows Improve interactions between color environment variables and CLI options Make allow-insecure-host a global option Only write .python-version files during uv init for workspace members if the version differs For detailed discussion of these changes, please see https://github.com/astral-sh/uv/releases/tag/0.5.0. For other fixes, enhancements, and changes in this update, please consult the following: https://github.com/astral-sh/uv/releases/tag/0.5.1 https://github.com/astral-sh/uv/releases/tag/0.5.2 https://github.com/astral-sh/uv/releases/tag/0.5.3 https://github.com/astral-sh/uv/releases/tag/0.5.4 https://github.com/astral-sh/uv/releases/tag/0.5.5 -------------------------------------------------------------------------------- ChangeLog: * Thu Nov 28 2024 Benjamin A. Beasley - 0.5.5-2 - Revert "Backport a path-escaping fix for the batch activation script" * Wed Nov 27 2024 Benjamin A. Beasley - 0.5.5-1 - Update to 0.5.5 (close RHBZ#2329188) * Wed Nov 27 2024 Benjamin A. Beasley - 0.5.4-2 - Backport a path-escaping fix for the batch activation script * Thu Nov 21 2024 Benjamin A. Beasley - 0.5.4-1 - Update to 0.5.4 (close RHBZ#2327512) * Thu Nov 21 2024 Benjamin A. Beasley - 0.5.3-1 - Update to 0.5.3 * Tue Nov 19 2024 Benjamin A. Beasley - 0.5.2-2 - Stop loosening the mailparse dependency version bound * Mon Nov 18 2024 Benjamin A. Beasley - 0.5.2-1 - Update to 0.5.2 (close RHBZ#2323792) * Sat Nov 16 2024 Benjamin A. Beasley - 0.5.1-1 - Update to 0.5.1 * Sat Nov 16 2024 Benjamin A. Beasley - 0.5.0-1 - Update to 0.5.0 * Thu Nov 14 2024 Benjamin A. Beasley - 0.4.30-4 - Also configure python-preference = "system" * Thu Nov 14 2024 Benjamin A. Beasley - 0.4.30-3 - Install a default system-wide uv.toml - Configure python-downloads ="manual" -------------------------------------------------------------------------------- References: [ 1 ] Bug #2327512 - uv-0.5.4 is available https://bugzilla.redhat.com/show_bug.cgi?id=2327512 [ 2 ] Bug #2328745 - CVE-2024-53899 uv: potential command injection via virtual environment activation scripts [fedora-40] https://bugzilla.redhat.com/show_bug.cgi?id=2328745 [ 3 ] Bug #2329188 - uv-0.5.5 is available https://bugzilla.redhat.com/show_bug.cgi?id=2329188 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2024-075f626765' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ -------------------------------------------------------------------------------- . Enhance uv in Fedora 40 to boost efficiency and address critical security vulnerabilities within this Python package manager.. Fedora 40 uv package, Python package installer, command injection fix, enhanced performance, update notification. . Severity: Critical. LinuxSecurity.com Team

Dec 07, 2024 •Critical Fedora