# SBOM for keyringrs 0.4.1 > Python bindings for the Rust keyring crate The Python package keyringrs 0.4.1 ships 14 SBOM files (CycloneDX) inside its wheels, under `.dist-info/sboms/` ([PEP 770](https://peps.python.org/pep-0770/)). - Package URL (PURL): `pkg:pypi/keyringrs@0.4.1` - PyPI: https://pypi.org/project/keyringrs/0.4.1/ - Author: The keyringrs developers - License: Apache-2.0 OR MIT - Requires Python: \>=3.9 - Homepage: - Repository: ## SBOMs ### keyringrs-0.4.1-cp39-abi3-macosx\_10\_12\_x86\_64.whl - [keyringrs-0.4.1.dist-info/sboms/keyringrs.cyclonedx.json](https://pypi.sbomify.com/artifact/a486e61d-df70-5423-989b-b388bd32555b/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 9 known vulnerabilities ### keyringrs-0.4.1-cp39-abi3-macosx\_11\_0\_arm64.whl - [keyringrs-0.4.1.dist-info/sboms/keyringrs.cyclonedx.json](https://pypi.sbomify.com/artifact/df7aba53-fbfa-5cf9-8221-1dd628b4859a/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 9 known vulnerabilities ### keyringrs-0.4.1-cp39-abi3-manylinux\_2\_17\_aarch64.manylinux2014\_aarch64.whl - [keyringrs-0.4.1.dist-info/sboms/keyringrs.cyclonedx.json](https://pypi.sbomify.com/artifact/a202213c-d965-5405-b406-b57d42487835/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 15 known vulnerabilities ### keyringrs-0.4.1-cp39-abi3-manylinux\_2\_17\_armv7l.manylinux2014\_armv7l.whl - [keyringrs-0.4.1.dist-info/sboms/keyringrs.cyclonedx.json](https://pypi.sbomify.com/artifact/a98eebee-b18c-5fc7-8eaf-498b365a0dbd/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 15 known vulnerabilities ### keyringrs-0.4.1-cp39-abi3-manylinux\_2\_17\_ppc64le.manylinux2014\_ppc64le.whl - [keyringrs-0.4.1.dist-info/sboms/keyringrs.cyclonedx.json](https://pypi.sbomify.com/artifact/d1c152e1-24fb-5be5-a7d0-ffbb0f7dc4fe/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 15 known vulnerabilities ### keyringrs-0.4.1-cp39-abi3-manylinux\_2\_17\_s390x.manylinux2014\_s390x.whl - [keyringrs-0.4.1.dist-info/sboms/keyringrs.cyclonedx.json](https://pypi.sbomify.com/artifact/74f64001-8576-5dd2-9a58-74b54a9ec736/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 15 known vulnerabilities ### keyringrs-0.4.1-cp39-abi3-manylinux\_2\_17\_x86\_64.manylinux2014\_x86\_64.whl - [keyringrs-0.4.1.dist-info/sboms/keyringrs.cyclonedx.json](https://pypi.sbomify.com/artifact/7d106d3a-a5aa-5add-8f58-6fb326c856f4/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 15 known vulnerabilities ### keyringrs-0.4.1-cp39-abi3-manylinux\_2\_5\_i686.manylinux1\_i686.whl - [keyringrs-0.4.1.dist-info/sboms/keyringrs.cyclonedx.json](https://pypi.sbomify.com/artifact/fc94988e-11f5-57e3-9a0a-324c36a2f2fc/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 15 known vulnerabilities ### keyringrs-0.4.1-cp39-abi3-musllinux\_1\_2\_aarch64.whl - [keyringrs-0.4.1.dist-info/sboms/keyringrs.cyclonedx.json](https://pypi.sbomify.com/artifact/5179f22d-d803-55f7-9e04-6c866a2edacc/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 15 known vulnerabilities ### keyringrs-0.4.1-cp39-abi3-musllinux\_1\_2\_armv7l.whl - [keyringrs-0.4.1.dist-info/sboms/keyringrs.cyclonedx.json](https://pypi.sbomify.com/artifact/7d6818f7-746f-52df-8ec9-12cc83ca4a34/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 15 known vulnerabilities ### keyringrs-0.4.1-cp39-abi3-musllinux\_1\_2\_i686.whl - [keyringrs-0.4.1.dist-info/sboms/keyringrs.cyclonedx.json](https://pypi.sbomify.com/artifact/0aa142af-40c8-5c52-a146-58b372b6840c/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 15 known vulnerabilities ### keyringrs-0.4.1-cp39-abi3-musllinux\_1\_2\_x86\_64.whl - [keyringrs-0.4.1.dist-info/sboms/keyringrs.cyclonedx.json](https://pypi.sbomify.com/artifact/d48d81f4-62cf-5867-846c-61ef5dcebe80/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 15 known vulnerabilities ### keyringrs-0.4.1-cp39-abi3-win32.whl - [keyringrs-0.4.1.dist-info/sboms/keyringrs.cyclonedx.json](https://pypi.sbomify.com/artifact/4062fbf2-0e05-540c-8697-a695a39093ff/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 9 known vulnerabilities ### keyringrs-0.4.1-cp39-abi3-win\_amd64.whl - [keyringrs-0.4.1.dist-info/sboms/keyringrs.cyclonedx.json](https://pypi.sbomify.com/artifact/df794e09-4a74-5bff-a583-dd75140a8fe4/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 9 known vulnerabilities ## Known vulnerabilities Components listed in these SBOMs, matched against the [OSV database](https://osv.dev/) as of 2026-11-09. | Vulnerability | Severity | Component | Fixed in | Summary | |---|---|---|---|---| | [CVE-2026-42327](https://insights.sbomify.com/CVE-2026-42327/) | high (8.7) | openssl 0.10.71 (crates.io) | 0.10.79 | rust-openssl has undefined behavior in X509Ref::ocsp\_responders for certificates with non-UTF-8 OCSP URLs | | [CVE-2026-41898](https://insights.sbomify.com/CVE-2026-41898/) | high (8.3) | openssl 0.10.71 (crates.io) | 0.10.78 | rust-openssl: Unchecked callback length in PSK/cookie trampolines leaks adjacent memory to peer | | [CVE-2026-41681](https://insights.sbomify.com/CVE-2026-41681/) | high (8.1) | openssl 0.10.71 (crates.io) | 0.10.78 | rust-openssl: rustMdCtxRef::digest\_final() writes past caller buffer with no length check | | [CVE-2026-41676](https://insights.sbomify.com/CVE-2026-41676/) | high (7.2) | openssl 0.10.71 (crates.io) | 0.10.78 | rust-openssl: Deriver::derive and PkeyCtxRef::derive can overflow short buffers on OpenSSL 1.1.1 | | [CVE-2026-41678](https://insights.sbomify.com/CVE-2026-41678/) | high (7.2) | openssl 0.10.71 (crates.io) | 0.10.78 | rust-openssl has incorrect bounds assertion in aes key wrap | | [RUSTSEC-2025-0022](https://osv.dev/vulnerability/RUSTSEC-2025-0022) | medium (6.3) | openssl 0.10.71 (crates.io) | 0.10.72 | Use-After-Free in \`Md::fetch\` and \`Cipher::fetch\` | | [CVE-2026-44662](https://insights.sbomify.com/CVE-2026-44662/) | medium (5.1) | openssl 0.10.71 (crates.io) | 0.10.79 | rust-openssl vulnerable to heap buffer overflow when encrypting with AES key-wrap-with-padding | | [CVE-2026-45784](https://insights.sbomify.com/CVE-2026-45784/) | medium (5.1) | openssl 0.10.71 (crates.io) | 0.10.80 | rust-openssl: Potential out-of-bounds write in \`CipherCtxRef::cipher\_update\_inplace\` for AES-KW-PAD ciphers | | [CVE-2026-41677](https://insights.sbomify.com/CVE-2026-41677/) | low (1.7) | openssl 0.10.71 (crates.io) | 0.10.78 | rust-opennssl has an Out-of-bounds read in PEM password callback when returning an oversized length | | [RUSTSEC-2026-0221](https://osv.dev/vulnerability/RUSTSEC-2026-0221) | unknown | event-listener 5.3.1 (crates.io) | 5.4.2 | \`event-listener\` allows \`!Send\` tags to cross thread boundaries via \`StackSlot\` | | [RUSTSEC-2026-0441](https://osv.dev/vulnerability/RUSTSEC-2026-0441) | unknown | pin-utils 0.1.0 (crates.io) | none listed | \`pin-utils\` is unmaintained | | [RUSTSEC-2026-0097](https://osv.dev/vulnerability/RUSTSEC-2026-0097) | unknown | rand 0.8.5 (crates.io) | 0.8.6 | Rand is unsound with a custom logger using \`rand::rng()\` | | [RUSTSEC-2026-0371](https://osv.dev/vulnerability/RUSTSEC-2026-0371) | unknown | zbus\_names 3.0.0 (crates.io) | none listed | \`zbus\_names\` is unmaintained | | [RUSTSEC-2026-0370](https://osv.dev/vulnerability/RUSTSEC-2026-0370) | unknown | zvariant 4.2.0 (crates.io) | none listed | \`zvariant\` is unmaintained | | [RUSTSEC-2026-0372](https://osv.dev/vulnerability/RUSTSEC-2026-0372) | unknown | zvariant\_derive 4.2.0 (crates.io) | none listed | \`zvariant\_derive\` is unmaintained | ## Fetch it over TEA This SBOM is served over the [Transparency Exchange API](https://github.com/CycloneDX/transparency-exchange-api) (TEA). With the `libtea` client: ``` pip install libtea python -m libtea https://pypi.sbomify.com pkg:pypi/keyringrs@0.4.1 ``` Machine-readable copy of this page: https://pypi.sbomify.com/package/keyringrs/0.4.1.json --- From pypi-tea by sbomify: https://pypi.sbomify.com/package/keyringrs/0.4.1