uv, Deno and Alpine packages bundle webpki root certificates
Original title: Re: Bundled cert stores + eMudhra cert issue (nmap/ncat, texlive-infra)
An Alpine edge SBOM check found 29 community and 41 testing packages potentially affected.
In an oss-security reply about bundled certificate stores and the eMudhra certificate issue, LN Liberda says some Rust codebases embed a cert store via the webpki-root-certs and webpki-roots crates. Named cases are uv, unless SSL_CERT_FILE or SSL_CERT_DIR is set, and Deno, unless DENO_TLS_CA_STORE=system is set. An SBOM check of Alpine Linux edge found 29 potentially affected community packages and 41 in testing.
Unconfirmed: Alpine packages are only described as potentially affected, and the certificate defect is not detailed in the snippet.
- The crates named are webpki-root-certs and webpki-roots.
- uv uses the bundled store unless SSL_CERT_FILE or SSL_CERT_DIR is set.
- Deno uses it unless DENO_TLS_CA_STORE=system is set.
- Alpine's count is described as potentially affected, not confirmed vulnerable.
Impact: Bundled trust stores may include the eMudhra certificate
| Product | Affected |
|---|---|
| Astral uv | — |
| Deno | — |
| Alpine Linux edge | edge |
- 1.Set SSL_CERT_FILE or SSL_CERT_DIR for uv to use a chosen store.
- 2.Set DENO_TLS_CA_STORE=system so Deno uses the system certificate store.
- Vendors
- Alpine Linux
- Organizations
- eMudhra
From the original article
Posted by LN Liberda on Oct 21 Certain Rust codebases include a cert store inside their binaries, https://crates. io/crates/webpki-root-certs https://crates. io/crates/webpki-roots This includes: * uv (used unless SSL_CERT_FILE or SSL_CERT_DIR are set), * deno (used unless DENO_TLS_CA_STORE=system is set) SBOM check at Alpine Linux edge: potentially affected 29 packages in community, 41 in testing.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.