# SBOM for rfernet 0.3.6 > Fast Fernet bindings for Python The Python package rfernet 0.3.6 ships 30 SBOM files (CycloneDX) inside its wheels, under `.dist-info/sboms/` ([PEP 770](https://peps.python.org/pep-0770/)). - Package URL (PURL): `pkg:pypi/rfernet@0.3.6` - PyPI: https://pypi.org/project/rfernet/0.3.6/ - Author: Aviram Hassan \ - License: MIT ## SBOMs ### rfernet-0.3.6-cp311-cp311-macosx\_11\_0\_arm64.whl - [rfernet-0.3.6.dist-info/sboms/rfernet.cyclonedx.json](https://pypi.sbomify.com/artifact/b3173ba1-918f-5d8a-9881-dfb1de65b494/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 8 known vulnerabilities ### rfernet-0.3.6-cp311-cp311-manylinux\_2\_28\_aarch64.whl - [rfernet-0.3.6.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/7e93a06b-5a47-50e1-8ae0-de416e26f1b9/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities - [rfernet-0.3.6.dist-info/sboms/rfernet.cyclonedx.json](https://pypi.sbomify.com/artifact/8faff9ef-4e35-53a6-bdc3-efd35d6c58eb/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 8 known vulnerabilities ### rfernet-0.3.6-cp311-cp311-manylinux\_2\_28\_x86\_64.whl - [rfernet-0.3.6.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/af757baa-2504-54e5-8ade-98e5faa35bc3/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities - [rfernet-0.3.6.dist-info/sboms/rfernet.cyclonedx.json](https://pypi.sbomify.com/artifact/266a97da-1a69-59b3-ab75-6e1e948cc5f4/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 8 known vulnerabilities ### rfernet-0.3.6-cp311-cp311-win\_amd64.whl - [rfernet-0.3.6.dist-info/sboms/rfernet.cyclonedx.json](https://pypi.sbomify.com/artifact/6eacc1ca-0653-55b5-b177-fc9e65d392e3/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 8 known vulnerabilities ### rfernet-0.3.6-cp312-cp312-macosx\_11\_0\_arm64.whl - [rfernet-0.3.6.dist-info/sboms/rfernet.cyclonedx.json](https://pypi.sbomify.com/artifact/adb49bfa-ffce-5712-9f3a-9051f9b4f4b3/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 8 known vulnerabilities ### rfernet-0.3.6-cp312-cp312-manylinux\_2\_28\_aarch64.whl - [rfernet-0.3.6.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/7cb98b0e-ebf7-5ccb-baf1-83c8be1850c2/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities - [rfernet-0.3.6.dist-info/sboms/rfernet.cyclonedx.json](https://pypi.sbomify.com/artifact/d704a1d7-fa46-5206-8651-61e361ff4255/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 8 known vulnerabilities ### rfernet-0.3.6-cp312-cp312-manylinux\_2\_28\_x86\_64.whl - [rfernet-0.3.6.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/6efc26e9-bb0b-5bb8-865f-ae184161224f/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities - [rfernet-0.3.6.dist-info/sboms/rfernet.cyclonedx.json](https://pypi.sbomify.com/artifact/d0605762-501b-5ef0-8e62-5482cb6bb9e5/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 8 known vulnerabilities ### rfernet-0.3.6-cp312-cp312-win\_amd64.whl - [rfernet-0.3.6.dist-info/sboms/rfernet.cyclonedx.json](https://pypi.sbomify.com/artifact/fc7e0466-fda5-5b43-964d-0191c82d6045/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 8 known vulnerabilities ### rfernet-0.3.6-cp313-cp313-macosx\_11\_0\_arm64.whl - [rfernet-0.3.6.dist-info/sboms/rfernet.cyclonedx.json](https://pypi.sbomify.com/artifact/16507825-2bfb-51aa-939c-591659cba717/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 8 known vulnerabilities ### rfernet-0.3.6-cp313-cp313-manylinux\_2\_28\_aarch64.whl - [rfernet-0.3.6.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/c65b483f-1dd1-5a18-b2c8-c6482aeb926b/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities - [rfernet-0.3.6.dist-info/sboms/rfernet.cyclonedx.json](https://pypi.sbomify.com/artifact/8dffa3b9-f321-5bd0-b143-1c043a698330/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 8 known vulnerabilities ### rfernet-0.3.6-cp313-cp313-manylinux\_2\_28\_x86\_64.whl - [rfernet-0.3.6.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/0060ab65-a6c1-5ade-a196-ccf8354a8489/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities - [rfernet-0.3.6.dist-info/sboms/rfernet.cyclonedx.json](https://pypi.sbomify.com/artifact/92d0c50d-0ad1-556f-9c31-0c2160dd31ef/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 8 known vulnerabilities ### rfernet-0.3.6-cp313-cp313-win\_amd64.whl - [rfernet-0.3.6.dist-info/sboms/rfernet.cyclonedx.json](https://pypi.sbomify.com/artifact/1aad24c3-05a5-5739-9ddc-e51167a52f2b/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 8 known vulnerabilities ### rfernet-0.3.6-cp314-cp314-macosx\_11\_0\_arm64.whl - [rfernet-0.3.6.dist-info/sboms/rfernet.cyclonedx.json](https://pypi.sbomify.com/artifact/081a33ec-1e06-53d6-93bc-9694519f7eb5/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 8 known vulnerabilities ### rfernet-0.3.6-cp314-cp314-manylinux\_2\_28\_aarch64.whl - [rfernet-0.3.6.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/64dfb849-0d94-5ca5-a655-290f958e3d48/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities - [rfernet-0.3.6.dist-info/sboms/rfernet.cyclonedx.json](https://pypi.sbomify.com/artifact/b615aa3b-06ed-50f2-8243-9beedff3257e/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 8 known vulnerabilities ### rfernet-0.3.6-cp314-cp314-manylinux\_2\_28\_x86\_64.whl - [rfernet-0.3.6.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/0a04b240-0a1a-5ca2-a27a-c84024d48a13/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities - [rfernet-0.3.6.dist-info/sboms/rfernet.cyclonedx.json](https://pypi.sbomify.com/artifact/c0a54bc0-9b2a-5940-80b2-cdb618fcf458/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 8 known vulnerabilities ### rfernet-0.3.6-cp314-cp314-win\_amd64.whl - [rfernet-0.3.6.dist-info/sboms/rfernet.cyclonedx.json](https://pypi.sbomify.com/artifact/74638e81-5dd2-5391-83f4-f4a1eb6b4f27/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 8 known vulnerabilities ### rfernet-0.3.6-cp315-cp315-macosx\_11\_0\_arm64.whl - [rfernet-0.3.6.dist-info/sboms/rfernet.cyclonedx.json](https://pypi.sbomify.com/artifact/ce5dee85-70f0-5381-a9fc-bc2c575dd345/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 8 known vulnerabilities ### rfernet-0.3.6-cp315-cp315-manylinux\_2\_28\_aarch64.whl - [rfernet-0.3.6.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/1d92c3f5-9ae0-5525-8c33-36e29c820784/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities - [rfernet-0.3.6.dist-info/sboms/rfernet.cyclonedx.json](https://pypi.sbomify.com/artifact/4e550e42-21ea-5bbd-bb95-ab8ae54633e2/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 8 known vulnerabilities ### rfernet-0.3.6-cp315-cp315-manylinux\_2\_28\_x86\_64.whl - [rfernet-0.3.6.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/66f33858-aa8e-5f2a-bc76-e29881e209d0/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities - [rfernet-0.3.6.dist-info/sboms/rfernet.cyclonedx.json](https://pypi.sbomify.com/artifact/177c8689-26f2-540d-ba77-85398738e5b0/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 8 known vulnerabilities ### rfernet-0.3.6-cp315-cp315-win\_amd64.whl - [rfernet-0.3.6.dist-info/sboms/rfernet.cyclonedx.json](https://pypi.sbomify.com/artifact/1aaa3379-9fc0-50e1-b4ac-a001a3dc8922/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 8 known vulnerabilities ## Known vulnerabilities Components listed in these SBOMs, matched against the [OSV database](https://osv.dev/) as of 2026-11-10. | Vulnerability | Severity | Component | Fixed in | Summary | |---|---|---|---|---| | [CVE-2026-42327](https://insights.sbomify.com/CVE-2026-42327/) | high (8.7) | openssl 0.10.73 (crates.io) | 0.10.79 | rust-openssl has undefined behavior in X509Ref::ocsp\_responders for certificates with non-UTF-8 OCSP URLs | | [CVE-2026-41898](https://insights.sbomify.com/CVE-2026-41898/) | high (8.3) | openssl 0.10.73 (crates.io) | 0.10.78 | rust-openssl: Unchecked callback length in PSK/cookie trampolines leaks adjacent memory to peer | | [CVE-2026-41681](https://insights.sbomify.com/CVE-2026-41681/) | high (8.1) | openssl 0.10.73 (crates.io) | 0.10.78 | rust-openssl: rustMdCtxRef::digest\_final() writes past caller buffer with no length check | | [CVE-2026-41676](https://insights.sbomify.com/CVE-2026-41676/) | high (7.2) | openssl 0.10.73 (crates.io) | 0.10.78 | rust-openssl: Deriver::derive and PkeyCtxRef::derive can overflow short buffers on OpenSSL 1.1.1 | | [CVE-2026-41678](https://insights.sbomify.com/CVE-2026-41678/) | high (7.2) | openssl 0.10.73 (crates.io) | 0.10.78 | Out-of-bounds write in \`aes::unwrap\_key\` | | [CVE-2026-44662](https://insights.sbomify.com/CVE-2026-44662/) | medium (5.1) | openssl 0.10.73 (crates.io) | 0.10.79 | rust-openssl vulnerable to heap buffer overflow when encrypting with AES key-wrap-with-padding | | [CVE-2026-45784](https://insights.sbomify.com/CVE-2026-45784/) | medium (5.1) | openssl 0.10.73 (crates.io) | 0.10.80 | rust-openssl: Potential out-of-bounds write in \`CipherCtxRef::cipher\_update\_inplace\` for AES-KW-PAD ciphers | | [CVE-2026-41677](https://insights.sbomify.com/CVE-2026-41677/) | low (1.7) | openssl 0.10.73 (crates.io) | 0.10.78 | rust-opennssl has an Out-of-bounds read in PEM password callback when returning an oversized length | ## Fetch it over TEA This SBOM is served over the [Transparency Exchange API](https://github.com/CycloneDX/transparency-exchange-api) (TEA). With the `libtea` client: ``` pip install libtea python -m libtea https://pypi.sbomify.com pkg:pypi/rfernet@0.3.6 ``` Machine-readable copy of this page: https://pypi.sbomify.com/package/rfernet/0.3.6.json --- From pypi-tea by sbomify: https://pypi.sbomify.com/package/rfernet/0.3.6