# SBOM for etebase 0.32.0 > Python client library for Etebase The Python package etebase 0.32.0 ships 4 SBOM files (CycloneDX) inside its wheels, under `.dist-info/sboms/` ([PEP 770](https://peps.python.org/pep-0770/)). - Package URL (PURL): `pkg:pypi/etebase@0.32.0` - PyPI: https://pypi.org/project/etebase/0.32.0/ - License: BSD-3-Clause - Requires Python: \>=3.9 - Homepage: ## SBOMs ### etebase-0.32.0-cp39-abi3-macosx\_11\_0\_arm64.whl - [etebase-0.32.0.dist-info/sboms/etebase-python.cyclonedx.json](https://pypi.sbomify.com/artifact/2af66f7c-afe8-5e8c-b2fa-a71f41c0cfe3/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 20 known vulnerabilities ### etebase-0.32.0-cp39-abi3-manylinux\_2\_28\_aarch64.whl - [etebase-0.32.0.dist-info/sboms/etebase-python.cyclonedx.json](https://pypi.sbomify.com/artifact/e9d1b166-b969-588e-b678-cdba0d6947f3/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 20 known vulnerabilities ### etebase-0.32.0-cp39-abi3-manylinux\_2\_28\_x86\_64.whl - [etebase-0.32.0.dist-info/sboms/etebase-python.cyclonedx.json](https://pypi.sbomify.com/artifact/81b5a814-d884-5fbe-8cb4-b4055f681b72/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 20 known vulnerabilities ### etebase-0.32.0-cp39-abi3-win\_amd64.whl - [etebase-0.32.0.dist-info/sboms/etebase-python.cyclonedx.json](https://pypi.sbomify.com/artifact/6249c057-8c3f-50b7-9f62-67efb0ad0fbe/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 20 known vulnerabilities ## Known vulnerabilities Components listed in these SBOMs, matched against the [OSV database](https://osv.dev/) as of 2026-11-10. | Vulnerability | Severity | Component | Fixed in | Summary | |---|---|---|---|---| | [CVE-2026-42327](https://insights.sbomify.com/CVE-2026-42327/) | high (8.7) | openssl 0.10.72 (crates.io) | 0.10.79 | rust-openssl has undefined behavior in X509Ref::ocsp\_responders for certificates with non-UTF-8 OCSP URLs | | [CVE-2026-41898](https://insights.sbomify.com/CVE-2026-41898/) | high (8.3) | openssl 0.10.72 (crates.io) | 0.10.78 | rust-openssl: Unchecked callback length in PSK/cookie trampolines leaks adjacent memory to peer | | [CVE-2026-41681](https://insights.sbomify.com/CVE-2026-41681/) | high (8.1) | openssl 0.10.72 (crates.io) | 0.10.78 | rust-openssl: rustMdCtxRef::digest\_final() writes past caller buffer with no length check | | [CVE-2024-27308](https://insights.sbomify.com/CVE-2024-27308/) | high (7.5) | mio 0.8.10 (crates.io) | 0.8.11 | Tokens for named pipes may be delivered after deregistration | | [CVE-2026-41676](https://insights.sbomify.com/CVE-2026-41676/) | high (7.2) | openssl 0.10.72 (crates.io) | 0.10.78 | rust-openssl: Deriver::derive and PkeyCtxRef::derive can overflow short buffers on OpenSSL 1.1.1 | | [CVE-2026-41678](https://insights.sbomify.com/CVE-2026-41678/) | high (7.2) | openssl 0.10.72 (crates.io) | 0.10.78 | Out-of-bounds write in \`aes::unwrap\_key\` | | [CVE-2024-12224](https://insights.sbomify.com/CVE-2024-12224/) | medium (6.3) | idna 0.5.0 (crates.io) | 1.0.0 | \`idna\` accepts Punycode labels that do not produce any non-ASCII when decoded | | [CVE-2026-25541](https://insights.sbomify.com/CVE-2026-25541/) | medium (5.5) | bytes 1.5.0 (crates.io) | 1.11.1 | Integer overflow in \`BytesMut::reserve\` | | [RUSTSEC-2024-0332](https://osv.dev/vulnerability/RUSTSEC-2024-0332) | medium (5.3) | h2 0.3.22 (crates.io) | 0.3.26 | Degradation of service in h2 servers with CONTINUATION Flood | | [CVE-2026-44662](https://insights.sbomify.com/CVE-2026-44662/) | medium (5.1) | openssl 0.10.72 (crates.io) | 0.10.79 | rust-openssl vulnerable to heap buffer overflow when encrypting with AES key-wrap-with-padding | | [CVE-2026-45784](https://insights.sbomify.com/CVE-2026-45784/) | medium (5.1) | openssl 0.10.72 (crates.io) | 0.10.80 | rust-openssl: Potential out-of-bounds write in \`CipherCtxRef::cipher\_update\_inplace\` for AES-KW-PAD ciphers | | [RUSTSEC-2025-0023](https://osv.dev/vulnerability/RUSTSEC-2025-0023) | low (2.7) | tokio 1.35.1 (crates.io) | 1.38.2 | Broadcast channel calls clone in parallel, but does not require \`Sync\` | | [CVE-2026-41677](https://insights.sbomify.com/CVE-2026-41677/) | low (1.7) | openssl 0.10.72 (crates.io) | 0.10.78 | rust-opennssl has an Out-of-bounds read in PEM password callback when returning an oversized length | | [RUSTSEC-2025-0056](https://osv.dev/vulnerability/RUSTSEC-2025-0056) | unknown | adler 1.0.2 (crates.io) | none listed | adler crate is unmaintained, use adler2 instead | | [RUSTSEC-2024-0003](https://osv.dev/vulnerability/RUSTSEC-2024-0003) | unknown | h2 0.3.22 (crates.io) | 0.3.24 | Resource exhaustion vulnerability in h2 may lead to Denial of Service (DoS) | | [RUSTSEC-2026-0258](https://osv.dev/vulnerability/RUSTSEC-2026-0258) | unknown | h2 0.3.22 (crates.io) | 0.4.16 | h2 unbounded empty DATA frames | | [RUSTSEC-2024-0436](https://osv.dev/vulnerability/RUSTSEC-2024-0436) | unknown | paste 1.0.14 (crates.io) | none listed | paste - no longer maintained | | [RUSTSEC-2026-0441](https://osv.dev/vulnerability/RUSTSEC-2026-0441) | unknown | pin-utils 0.1.0 (crates.io) | none listed | \`pin-utils\` is unmaintained | | [RUSTSEC-2021-0137](https://osv.dev/vulnerability/RUSTSEC-2021-0137) | unknown | sodiumoxide 0.2.7 (crates.io) | none listed | sodiumoxide is deprecated | | [RUSTSEC-2026-0386](https://osv.dev/vulnerability/RUSTSEC-2026-0386) | unknown | tokio 1.35.1 (crates.io) | 1.51.6 | \`AsyncFd::new\` and related constructors violate I/O safety | ## Fetch it over TEA This SBOM is served over the [Transparency Exchange API](https://github.com/CycloneDX/transparency-exchange-api) (TEA). With the `libtea` client: ``` pip install libtea python -m libtea https://pypi.sbomify.com pkg:pypi/etebase@0.32.0 ``` Machine-readable copy of this page: https://pypi.sbomify.com/package/etebase/0.32.0.json --- From pypi-tea by sbomify: https://pypi.sbomify.com/package/etebase/0.32.0