GHSA-hq85-5cpj-mr62: Pip/uv vulnerability
By default, uv verifies TLS connections against a vendored copy of the webpki-root-certs bundle. Versions before 0.13.4 include the emSign ECC Root CA - G3 root. Eight eMudhra intermediate CA certificates that chain to that root have compromised private keys, and the CA has revoked them.
An attacker with one of the compromised keys can issue certificates that uv accepts for any hostname, and can be used to issue certificates to enable MITM attacks.
uv 0.13.4 removes the root from its vendored bundle, following webpki-root-certs 1.0.10. Upgrade to 0.13.4 or later.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/uvto a version that resolves this vulnerability.Fixed in 0.13.4 - Upgrade
Upgrade
uvto a version that resolves this vulnerability.Fixed in 0.13.4
Event History
Frequently Asked Questions
Which deployments are exposed?
uv versions before 0.13.4 are exposed when they use uv's default TLS verification, which relies on its vendored webpki-root-certs bundle. That bundle includes the affected emSign ECC Root CA - G3 root.
What does an attacker need to exploit this?
An attacker needs one of the compromised private keys for the eight revoked eMudhra intermediate CA certificates that chain to the affected root. Such a key can be used to issue a certificate that vulnerable uv versions accept for any hostname, enabling a man-in-the-middle attack.
What should be done if the affected default trust bundle is in use?
Upgrade uv to version 0.13.4 or later. This version removes the affected root from uv's vendored bundle.