# SBOM for fetter 4.0.1 > System-wide Python package discovery, validation, and allow-listing. The Python package fetter 4.0.1 ships 45 SBOM files (CycloneDX) inside its wheels, under `.dist-info/sboms/` ([PEP 770](https://peps.python.org/pep-0770/)). - Package URL (PURL): `pkg:pypi/fetter@4.0.1` - PyPI: https://pypi.org/project/fetter/4.0.1/ - Author: Christopher Ariza - Requires Python: \>=3.9 - Homepage: - Issues: - Repository: ## SBOMs ### fetter-4.0.1-cp310-cp310-macosx\_10\_12\_x86\_64.whl - [fetter-4.0.1.dist-info/sboms/fetter.cyclonedx.json](https://pypi.sbomify.com/artifact/78ea5f6b-b4bf-51f5-8707-9c2172a073f6/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 15 known vulnerabilities ### fetter-4.0.1-cp310-cp310-macosx\_11\_0\_arm64.whl - [fetter-4.0.1.dist-info/sboms/fetter.cyclonedx.json](https://pypi.sbomify.com/artifact/71b8cb56-cced-5d2d-88c0-f97b0458ade5/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 15 known vulnerabilities ### fetter-4.0.1-cp310-cp310-manylinux\_2\_17\_armv7l.manylinux2014\_armv7l.whl - [fetter-4.0.1.dist-info/sboms/fetter.cyclonedx.json](https://pypi.sbomify.com/artifact/804719c9-2bb7-57d7-a760-140ea0f075e6/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 15 known vulnerabilities ### fetter-4.0.1-cp310-cp310-manylinux\_2\_17\_i686.manylinux2014\_i686.whl - [fetter-4.0.1.dist-info/sboms/fetter.cyclonedx.json](https://pypi.sbomify.com/artifact/4ee78d51-e61c-504a-bb52-3544e4670942/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 15 known vulnerabilities ### fetter-4.0.1-cp310-cp310-manylinux\_2\_17\_ppc64le.manylinux2014\_ppc64le.whl - [fetter-4.0.1.dist-info/sboms/fetter.cyclonedx.json](https://pypi.sbomify.com/artifact/d17841e9-f488-502a-91ea-b97eba14d50b/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 15 known vulnerabilities ### fetter-4.0.1-cp310-cp310-manylinux\_2\_17\_s390x.manylinux2014\_s390x.whl - [fetter-4.0.1.dist-info/sboms/fetter.cyclonedx.json](https://pypi.sbomify.com/artifact/fe7c2909-51ac-5ec6-85d0-e52bd37fca32/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 15 known vulnerabilities ### fetter-4.0.1-cp310-cp310-manylinux\_2\_17\_x86\_64.manylinux2014\_x86\_64.whl - [fetter-4.0.1.dist-info/sboms/fetter.cyclonedx.json](https://pypi.sbomify.com/artifact/2e523ff9-a61f-5c5b-bbad-1dcb9e8cb4d1/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 15 known vulnerabilities ### fetter-4.0.1-cp310-cp310-win32.whl - [fetter-4.0.1.dist-info/sboms/fetter.cyclonedx.json](https://pypi.sbomify.com/artifact/94862253-9199-56df-9108-e280e54a72fe/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 15 known vulnerabilities ### fetter-4.0.1-cp310-cp310-win\_amd64.whl - [fetter-4.0.1.dist-info/sboms/fetter.cyclonedx.json](https://pypi.sbomify.com/artifact/81f371cd-16f6-5d13-9bd2-c8fd9591315b/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 15 known vulnerabilities ### fetter-4.0.1-cp311-cp311-macosx\_10\_12\_x86\_64.whl - [fetter-4.0.1.dist-info/sboms/fetter.cyclonedx.json](https://pypi.sbomify.com/artifact/87214cc9-29f8-5705-a6b7-fbaa4c09b44d/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 15 known vulnerabilities ### fetter-4.0.1-cp311-cp311-macosx\_11\_0\_arm64.whl - [fetter-4.0.1.dist-info/sboms/fetter.cyclonedx.json](https://pypi.sbomify.com/artifact/a347eee4-0fc7-5f51-92a5-e1c1f3d0928d/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 15 known vulnerabilities ### fetter-4.0.1-cp311-cp311-manylinux\_2\_17\_armv7l.manylinux2014\_armv7l.whl - [fetter-4.0.1.dist-info/sboms/fetter.cyclonedx.json](https://pypi.sbomify.com/artifact/ddcc2859-0614-5833-ad5c-e9441bedb54d/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 15 known vulnerabilities ### fetter-4.0.1-cp311-cp311-manylinux\_2\_17\_i686.manylinux2014\_i686.whl - [fetter-4.0.1.dist-info/sboms/fetter.cyclonedx.json](https://pypi.sbomify.com/artifact/f8ee94b8-2460-5b3b-b904-528fb15c4b76/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 15 known vulnerabilities ### fetter-4.0.1-cp311-cp311-manylinux\_2\_17\_ppc64le.manylinux2014\_ppc64le.whl - [fetter-4.0.1.dist-info/sboms/fetter.cyclonedx.json](https://pypi.sbomify.com/artifact/338ebdae-d8ad-54e8-b7c8-c753a2d3b0e8/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 15 known vulnerabilities ### fetter-4.0.1-cp311-cp311-manylinux\_2\_17\_s390x.manylinux2014\_s390x.whl - [fetter-4.0.1.dist-info/sboms/fetter.cyclonedx.json](https://pypi.sbomify.com/artifact/7af70243-ecdb-5c47-b52e-282aa508ab08/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 15 known vulnerabilities ### fetter-4.0.1-cp311-cp311-manylinux\_2\_17\_x86\_64.manylinux2014\_x86\_64.whl - [fetter-4.0.1.dist-info/sboms/fetter.cyclonedx.json](https://pypi.sbomify.com/artifact/8297e12a-8475-52f0-922c-5933c91686c5/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 15 known vulnerabilities ### fetter-4.0.1-cp311-cp311-win32.whl - [fetter-4.0.1.dist-info/sboms/fetter.cyclonedx.json](https://pypi.sbomify.com/artifact/551ca00a-014f-5896-8040-a0fc7486d344/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 15 known vulnerabilities ### fetter-4.0.1-cp311-cp311-win\_amd64.whl - [fetter-4.0.1.dist-info/sboms/fetter.cyclonedx.json](https://pypi.sbomify.com/artifact/d49b84ff-8bc3-5a91-86fd-8c6caca9ad17/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 15 known vulnerabilities ### fetter-4.0.1-cp312-cp312-macosx\_10\_12\_x86\_64.whl - [fetter-4.0.1.dist-info/sboms/fetter.cyclonedx.json](https://pypi.sbomify.com/artifact/ffeb8ffb-cacf-5316-9c39-c3a95634b7b3/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 15 known vulnerabilities ### fetter-4.0.1-cp312-cp312-macosx\_11\_0\_arm64.whl - [fetter-4.0.1.dist-info/sboms/fetter.cyclonedx.json](https://pypi.sbomify.com/artifact/bbc47d22-3b00-5453-9d66-c603b69933ab/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 15 known vulnerabilities ### fetter-4.0.1-cp312-cp312-manylinux\_2\_17\_armv7l.manylinux2014\_armv7l.whl - [fetter-4.0.1.dist-info/sboms/fetter.cyclonedx.json](https://pypi.sbomify.com/artifact/33696f89-4026-594d-a468-df6fbadaeec7/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 15 known vulnerabilities ### fetter-4.0.1-cp312-cp312-manylinux\_2\_17\_i686.manylinux2014\_i686.whl - [fetter-4.0.1.dist-info/sboms/fetter.cyclonedx.json](https://pypi.sbomify.com/artifact/b3e00b89-aad9-5b11-8234-a283c60ae842/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 15 known vulnerabilities ### fetter-4.0.1-cp312-cp312-manylinux\_2\_17\_ppc64le.manylinux2014\_ppc64le.whl - [fetter-4.0.1.dist-info/sboms/fetter.cyclonedx.json](https://pypi.sbomify.com/artifact/688d6958-b3cb-5d0a-91a7-fcccfefb6457/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 15 known vulnerabilities ### fetter-4.0.1-cp312-cp312-manylinux\_2\_17\_s390x.manylinux2014\_s390x.whl - [fetter-4.0.1.dist-info/sboms/fetter.cyclonedx.json](https://pypi.sbomify.com/artifact/0edc23a8-152c-5889-a75a-44dc0c6bd7b7/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 15 known vulnerabilities ### fetter-4.0.1-cp312-cp312-manylinux\_2\_17\_x86\_64.manylinux2014\_x86\_64.whl - [fetter-4.0.1.dist-info/sboms/fetter.cyclonedx.json](https://pypi.sbomify.com/artifact/0ab6a595-88ca-5672-9e96-f4ab55b2503f/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 15 known vulnerabilities ### fetter-4.0.1-cp312-cp312-win32.whl - [fetter-4.0.1.dist-info/sboms/fetter.cyclonedx.json](https://pypi.sbomify.com/artifact/15390ffa-86e6-5ad7-ac7a-df8f23e15ca5/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 15 known vulnerabilities ### fetter-4.0.1-cp312-cp312-win\_amd64.whl - [fetter-4.0.1.dist-info/sboms/fetter.cyclonedx.json](https://pypi.sbomify.com/artifact/d41e873e-3241-5e61-8178-3c586e2ca6d9/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 15 known vulnerabilities ### fetter-4.0.1-cp313-cp313-macosx\_10\_12\_x86\_64.whl - [fetter-4.0.1.dist-info/sboms/fetter.cyclonedx.json](https://pypi.sbomify.com/artifact/d7f7b5e0-70d1-5d7b-920e-3734339feacb/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 15 known vulnerabilities ### fetter-4.0.1-cp313-cp313-macosx\_11\_0\_arm64.whl - [fetter-4.0.1.dist-info/sboms/fetter.cyclonedx.json](https://pypi.sbomify.com/artifact/f0c4222a-c104-57ba-96bb-fdcc499a732e/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 15 known vulnerabilities ### fetter-4.0.1-cp313-cp313-manylinux\_2\_17\_armv7l.manylinux2014\_armv7l.whl - [fetter-4.0.1.dist-info/sboms/fetter.cyclonedx.json](https://pypi.sbomify.com/artifact/9457e48d-2b67-57f4-a305-a287f51320dd/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 15 known vulnerabilities ### fetter-4.0.1-cp313-cp313-manylinux\_2\_17\_i686.manylinux2014\_i686.whl - [fetter-4.0.1.dist-info/sboms/fetter.cyclonedx.json](https://pypi.sbomify.com/artifact/8c50b359-5991-51d2-8543-a32398e98e1f/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 15 known vulnerabilities ### fetter-4.0.1-cp313-cp313-manylinux\_2\_17\_ppc64le.manylinux2014\_ppc64le.whl - [fetter-4.0.1.dist-info/sboms/fetter.cyclonedx.json](https://pypi.sbomify.com/artifact/fe622b21-10b1-5ab0-8c8c-581471e7195f/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 15 known vulnerabilities ### fetter-4.0.1-cp313-cp313-manylinux\_2\_17\_s390x.manylinux2014\_s390x.whl - [fetter-4.0.1.dist-info/sboms/fetter.cyclonedx.json](https://pypi.sbomify.com/artifact/c732fa09-a360-56dd-8b61-e0a47e1a57f7/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 15 known vulnerabilities ### fetter-4.0.1-cp313-cp313-manylinux\_2\_17\_x86\_64.manylinux2014\_x86\_64.whl - [fetter-4.0.1.dist-info/sboms/fetter.cyclonedx.json](https://pypi.sbomify.com/artifact/860d31b5-8ac7-5a33-9440-090b29e6211e/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 15 known vulnerabilities ### fetter-4.0.1-cp313-cp313-win32.whl - [fetter-4.0.1.dist-info/sboms/fetter.cyclonedx.json](https://pypi.sbomify.com/artifact/40b307c9-fde7-5eb0-860a-3603770f0367/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 15 known vulnerabilities ### fetter-4.0.1-cp313-cp313-win\_amd64.whl - [fetter-4.0.1.dist-info/sboms/fetter.cyclonedx.json](https://pypi.sbomify.com/artifact/3647212b-9140-55a9-af82-ab0f993e9c54/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 15 known vulnerabilities ### fetter-4.0.1-cp314-cp314-macosx\_10\_12\_x86\_64.whl - [fetter-4.0.1.dist-info/sboms/fetter.cyclonedx.json](https://pypi.sbomify.com/artifact/561f0cf3-495e-5938-bdea-0436b8cde51c/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 15 known vulnerabilities ### fetter-4.0.1-cp314-cp314-macosx\_11\_0\_arm64.whl - [fetter-4.0.1.dist-info/sboms/fetter.cyclonedx.json](https://pypi.sbomify.com/artifact/85396011-c501-5ffe-bde1-af2dd6e99cea/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 15 known vulnerabilities ### fetter-4.0.1-cp314-cp314-manylinux\_2\_17\_armv7l.manylinux2014\_armv7l.whl - [fetter-4.0.1.dist-info/sboms/fetter.cyclonedx.json](https://pypi.sbomify.com/artifact/887794b8-8321-5958-bd11-a80cce1b7241/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 15 known vulnerabilities ### fetter-4.0.1-cp314-cp314-manylinux\_2\_17\_i686.manylinux2014\_i686.whl - [fetter-4.0.1.dist-info/sboms/fetter.cyclonedx.json](https://pypi.sbomify.com/artifact/4ef53fb0-56ea-5e2e-ba0d-207f982b0f23/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 15 known vulnerabilities ### fetter-4.0.1-cp314-cp314-manylinux\_2\_17\_ppc64le.manylinux2014\_ppc64le.whl - [fetter-4.0.1.dist-info/sboms/fetter.cyclonedx.json](https://pypi.sbomify.com/artifact/4eadc96c-f255-5c20-9bb5-788ca884d98c/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 15 known vulnerabilities ### fetter-4.0.1-cp314-cp314-manylinux\_2\_17\_s390x.manylinux2014\_s390x.whl - [fetter-4.0.1.dist-info/sboms/fetter.cyclonedx.json](https://pypi.sbomify.com/artifact/951e9a73-8ad9-5a6a-ab7c-a71fcad8ea6d/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 15 known vulnerabilities ### fetter-4.0.1-cp314-cp314-manylinux\_2\_17\_x86\_64.manylinux2014\_x86\_64.whl - [fetter-4.0.1.dist-info/sboms/fetter.cyclonedx.json](https://pypi.sbomify.com/artifact/cadc5b9c-86cf-59da-8908-f29cc2dda621/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 15 known vulnerabilities ### fetter-4.0.1-cp314-cp314-win32.whl - [fetter-4.0.1.dist-info/sboms/fetter.cyclonedx.json](https://pypi.sbomify.com/artifact/fa7bb68c-c258-544d-9db5-d56ac19c4390/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 15 known vulnerabilities ### fetter-4.0.1-cp314-cp314-win\_amd64.whl - [fetter-4.0.1.dist-info/sboms/fetter.cyclonedx.json](https://pypi.sbomify.com/artifact/2a6ade29-fe99-5fbe-8f5a-aef0b070111a/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 15 known vulnerabilities ## Known vulnerabilities Components listed in these SBOMs, matched against the [OSV database](https://osv.dev/) as of 2026-11-10. | Vulnerability | Severity | Component | Fixed in | Summary | |---|---|---|---|---| | [RUSTSEC-2026-0176](https://osv.dev/vulnerability/RUSTSEC-2026-0176) | high (8.7) | pyo3 0.28.3 (crates.io) | 0.29.0 | Out-of-bounds read in \`nth\` / \`nth\_back\` for \`PyList\` and \`PyTuple\` iterators | | [CVE-2026-93599](https://insights.sbomify.com/CVE-2026-93599/) | high (7.5) | rustls-webpki 0.103.1 (crates.io) | 0.103.13 | Reachable panic in certificate revocation list parsing | | [RUSTSEC-2026-0177](https://osv.dev/vulnerability/RUSTSEC-2026-0177) | medium (6.3) | pyo3 0.28.3 (crates.io) | 0.29.0 | Missing \`Sync\` bound on \`PyCFunction::new\_closure\` closures | | [CVE-2026-25541](https://insights.sbomify.com/CVE-2026-25541/) | medium (5.5) | bytes 1.11.0 (crates.io) | 1.11.1 | Integer overflow in \`BytesMut::reserve\` | | [CVE-2026-123613](https://insights.sbomify.com/CVE-2026-123613/) | medium (5.3) | rustls 0.23.25 (crates.io) | 0.23.45 | TLS 1.3 handshake messages incorrectly accepted across encryption level boundaries | | [CVE-2026-93602](https://insights.sbomify.com/CVE-2026-93602/) | medium (4.4) | rustls-webpki 0.103.1 (crates.io) | 0.103.10 | CRLs not considered authoritative by Distribution Point due to faulty matching logic | | [CVE-2026-123609](https://insights.sbomify.com/CVE-2026-123609/) | medium (4.0) | rustls 0.23.25 (crates.io) | 0.23.46 | \`Debug\` impls for client session values expose TLS secrets | | [CVE-2026-123610](https://insights.sbomify.com/CVE-2026-123610/) | low (3.7) | rustls 0.23.25 (crates.io) | 0.23.46 | Brotli certificate decompression can allocate up to 1 GiB before authentication | | [CVE-2026-123611](https://insights.sbomify.com/CVE-2026-123611/) | low (3.7) | rustls 0.23.25 (crates.io) | 0.23.46 | Unauthenticated ServerHello can downgrade later connections to classical key exchange | | [CVE-2026-93600](https://insights.sbomify.com/CVE-2026-93600/) | low (2.2) | rustls-webpki 0.103.1 (crates.io) | 0.103.12 | Name constraints for URI names were incorrectly accepted | | [CVE-2026-93601](https://insights.sbomify.com/CVE-2026-93601/) | low (2.2) | rustls-webpki 0.103.1 (crates.io) | 0.103.12 | Name constraints were accepted for certificates asserting a wildcard name | | [RUSTSEC-2026-0204](https://osv.dev/vulnerability/RUSTSEC-2026-0204) | unknown | crossbeam-epoch 0.9.18 (crates.io) | 0.9.20 | Invalid pointer dereference in \`fmt::Pointer\` impl for \`Atomic\` and \`Shared\` when the underlying pointer is invalid | | [CVE-2026-111943](https://insights.sbomify.com/CVE-2026-111943/) | unknown | rustls-webpki 0.103.1 (crates.io) | 0.103.16 | Certificate verification may accept distrusted intermediates | | [RUSTSEC-2024-0449](https://osv.dev/vulnerability/RUSTSEC-2024-0449) | unknown | unsafe-libyaml 0.2.11 (crates.io) | none listed | unsafe-libyaml is unmaintained | | [CVE-2026-111943](https://insights.sbomify.com/CVE-2026-111943/) | unknown | webpki-roots 1.0.5 (crates.io) | 1.0.10 | Bundled root certificates allow trust in distrusted emSign intermediates | ## Fetch it over TEA This SBOM is served over the [Transparency Exchange API](https://github.com/CycloneDX/transparency-exchange-api) (TEA). With the `libtea` client: ``` pip install libtea python -m libtea https://pypi.sbomify.com pkg:pypi/fetter@4.0.1 ``` Machine-readable copy of this page: https://pypi.sbomify.com/package/fetter/4.0.1.json --- From pypi-tea by sbomify: https://pypi.sbomify.com/package/fetter/4.0.1