# SBOM for dttlib 0.12.5 > Advanced LIGO core library for online and offline frequency-domain diagnostics tool. The Python package dttlib 0.12.5 ships 15 SBOM files (CycloneDX) inside its wheels, under `.dist-info/sboms/` ([PEP 770](https://peps.python.org/pep-0770/)). - Package URL (PURL): `pkg:pypi/dttlib@0.12.5` - PyPI: https://pypi.org/project/dttlib/0.12.5/ - Author: Erik von Reis \ - Requires Python: \>=3.9 - Homepage: ## SBOMs ### dttlib-0.12.5-cp310-cp310-macosx\_11\_0\_arm64.whl - [dttlib-0.12.5.dist-info/sboms/dttlib.cyclonedx.json](https://pypi.sbomify.com/artifact/688f12b4-d452-5e82-abb4-9af8159be56b/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 13 known vulnerabilities ### dttlib-0.12.5-cp310-cp310-manylinux\_2\_31\_x86\_64.whl - [dttlib-0.12.5.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/a22e932f-7873-56f7-82a7-bb2097018822/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities - [dttlib-0.12.5.dist-info/sboms/dttlib.cyclonedx.json](https://pypi.sbomify.com/artifact/3114899b-5d2c-5736-b3b5-36b0a4d7a628/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 13 known vulnerabilities ### dttlib-0.12.5-cp311-cp311-macosx\_11\_0\_arm64.whl - [dttlib-0.12.5.dist-info/sboms/dttlib.cyclonedx.json](https://pypi.sbomify.com/artifact/e66c6bb9-c1ba-56d2-b778-72eb4582edd9/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 13 known vulnerabilities ### dttlib-0.12.5-cp311-cp311-manylinux\_2\_31\_x86\_64.whl - [dttlib-0.12.5.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/dc27b0d4-958e-5731-9f90-ad673f2d10d8/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities - [dttlib-0.12.5.dist-info/sboms/dttlib.cyclonedx.json](https://pypi.sbomify.com/artifact/71702f16-0829-57b2-b2a3-1ce43dab1177/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 13 known vulnerabilities ### dttlib-0.12.5-cp312-cp312-macosx\_11\_0\_arm64.whl - [dttlib-0.12.5.dist-info/sboms/dttlib.cyclonedx.json](https://pypi.sbomify.com/artifact/7248e415-4e14-55d1-b48c-897d8a302971/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 13 known vulnerabilities ### dttlib-0.12.5-cp312-cp312-manylinux\_2\_31\_x86\_64.whl - [dttlib-0.12.5.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/4abba2d5-9fc5-56cf-a506-f8959e144b9f/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities - [dttlib-0.12.5.dist-info/sboms/dttlib.cyclonedx.json](https://pypi.sbomify.com/artifact/3b1f07c1-d954-5e17-9986-86b492dc587b/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 13 known vulnerabilities ### dttlib-0.12.5-cp313-cp313-macosx\_11\_0\_arm64.whl - [dttlib-0.12.5.dist-info/sboms/dttlib.cyclonedx.json](https://pypi.sbomify.com/artifact/655bea2f-ef06-5f9d-afc8-89cc781adf76/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 13 known vulnerabilities ### dttlib-0.12.5-cp313-cp313-manylinux\_2\_31\_x86\_64.whl - [dttlib-0.12.5.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/8be73737-27d2-5476-875c-e0c0f8d0f32b/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities - [dttlib-0.12.5.dist-info/sboms/dttlib.cyclonedx.json](https://pypi.sbomify.com/artifact/6e08caa6-9a00-53b4-83af-59095026a5ab/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 13 known vulnerabilities ### dttlib-0.12.5-cp39-cp39-macosx\_11\_0\_arm64.whl - [dttlib-0.12.5.dist-info/sboms/dttlib.cyclonedx.json](https://pypi.sbomify.com/artifact/c2d58a8c-9f32-520b-b4c0-e03cb96fd09c/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 13 known vulnerabilities ### dttlib-0.12.5-cp39-cp39-manylinux\_2\_31\_x86\_64.whl - [dttlib-0.12.5.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/e453d66c-132a-52ff-9d2f-96c2bf3a4a0d/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities - [dttlib-0.12.5.dist-info/sboms/dttlib.cyclonedx.json](https://pypi.sbomify.com/artifact/c54827c8-50f7-5d95-816d-619d548fb5af/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 13 known vulnerabilities ## Known vulnerabilities Components listed in these SBOMs, matched against the [OSV database](https://osv.dev/) as of 2026-11-10. | Vulnerability | Severity | Component | Fixed in | Summary | |---|---|---|---|---| | [RUSTSEC-2026-0176](https://osv.dev/vulnerability/RUSTSEC-2026-0176) | high (8.7) | pyo3 0.24.2 (crates.io) | 0.29.0 | Out-of-bounds read in \`nth\` / \`nth\_back\` for \`PyList\` and \`PyTuple\` iterators | | [RUSTSEC-2026-0177](https://osv.dev/vulnerability/RUSTSEC-2026-0177) | medium (6.3) | pyo3 0.24.2 (crates.io) | 0.29.0 | Missing \`Sync\` bound on \`PyCFunction::new\_closure\` closures | | [CVE-2026-25537](https://insights.sbomify.com/CVE-2026-25537/) | medium (5.5) | jsonwebtoken 9.3.1 (crates.io) | 10.3.0 | jsonwebtoken has Type Confusion that leads to potential authorization bypass | | [CVE-2026-123609](https://insights.sbomify.com/CVE-2026-123609/) | medium (4.0) | rustls 0.23.45 (crates.io) | 0.23.46 | \`Debug\` impls for client session values expose TLS secrets | | [CVE-2026-123610](https://insights.sbomify.com/CVE-2026-123610/) | low (3.7) | rustls 0.23.45 (crates.io) | 0.23.46 | Brotli certificate decompression can allocate up to 1 GiB before authentication | | [CVE-2026-123611](https://insights.sbomify.com/CVE-2026-123611/) | low (3.7) | rustls 0.23.45 (crates.io) | 0.23.46 | Unauthenticated ServerHello can downgrade later connections to classical key exchange | | [CVE-2026-123612](https://insights.sbomify.com/CVE-2026-123612/) | low (2.3) | rustls 0.23.45 (crates.io) | 0.23.46 | Buffered application data sent to outer server after ECH rejection | | [CVE-2026-111959](https://insights.sbomify.com/CVE-2026-111959/) | unknown | arrow-data 54.3.1 (crates.io) | 57.3.2 | Apache Arrow Rust: Improper validation of RunEndEncoded arrays allows out of bounds reads | | [RUSTSEC-2026-0418](https://osv.dev/vulnerability/RUSTSEC-2026-0418) | unknown | libz-sys 1.1.29 (crates.io) | 1.1.31 | libz-sys build script leaks environment variables in the build directory | | [CVE-2026-111943](https://insights.sbomify.com/CVE-2026-111943/) | unknown | rustls-webpki 0.103.15 (crates.io) | 0.103.16 | Certificate verification may accept distrusted intermediates | | [RUSTSEC-2026-0386](https://osv.dev/vulnerability/RUSTSEC-2026-0386) | unknown | tokio 1.53.1 (crates.io) | 1.53.3 | \`AsyncFd::new\` and related constructors violate I/O safety | | [CVE-2026-111943](https://insights.sbomify.com/CVE-2026-111943/) | unknown | webpki-roots 1.0.9 (crates.io) | 1.0.10 | Bundled root certificates allow trust in distrusted emSign intermediates | | [RUSTSEC-2026-0410](https://osv.dev/vulnerability/RUSTSEC-2026-0410) | unknown | zstd-sys 2.0.16+zstd.1.5.7 (crates.io) | 2.1.2 | WebAssembly allocator shim corrupts memory on allocation failure | ## Fetch it over TEA This SBOM is served over the [Transparency Exchange API](https://github.com/CycloneDX/transparency-exchange-api) (TEA). With the `libtea` client: ``` pip install libtea python -m libtea https://pypi.sbomify.com pkg:pypi/dttlib@0.12.5 ``` Machine-readable copy of this page: https://pypi.sbomify.com/package/dttlib/0.12.5.json --- From pypi-tea by sbomify: https://pypi.sbomify.com/package/dttlib/0.12.5