# SBOM for yara-x 1.23.0 > Python bindings for YARA-X The Python package yara-x 1.23.0 ships 10 SBOM files (CycloneDX) inside its wheels, under `.dist-info/sboms/` ([PEP 770](https://peps.python.org/pep-0770/)). Its wheels carry a verified PEP 740 attestation. - Package URL (PURL): `pkg:pypi/yara-x@1.23.0` - PyPI: https://pypi.org/project/yara-x/1.23.0/ - Requires Python: \>=3.9 - Homepage: - repository: ## SBOMs ### yara\_x-1.23.0-cp39-abi3-macosx\_14\_0\_arm64.whl PEP 740 attestation verified (GitHub, VirusTotal/yara-x, workflow release.yaml). - [yara\_x-1.23.0.dist-info/sboms/yara-x-py.cyclonedx.json](https://pypi.sbomify.com/artifact/2388d8b2-7b36-5ad3-b2d5-924f30b1f2b8/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 4 known vulnerabilities ### yara\_x-1.23.0-cp39-abi3-macosx\_14\_0\_x86\_64.whl PEP 740 attestation verified (GitHub, VirusTotal/yara-x, workflow release.yaml). - [yara\_x-1.23.0.dist-info/sboms/yara-x-py.cyclonedx.json](https://pypi.sbomify.com/artifact/cb2d6a63-fdbd-58b7-a638-69a0a5043a95/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 4 known vulnerabilities ### yara\_x-1.23.0-cp39-abi3-manylinux\_2\_28\_aarch64.whl PEP 740 attestation verified (GitHub, VirusTotal/yara-x, workflow release.yaml). - [yara\_x-1.23.0.dist-info/sboms/yara-x-py.cyclonedx.json](https://pypi.sbomify.com/artifact/4cc89137-51ef-5a37-8534-d3be58a08635/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 4 known vulnerabilities ### yara\_x-1.23.0-cp39-abi3-manylinux\_2\_28\_x86\_64.whl PEP 740 attestation verified (GitHub, VirusTotal/yara-x, workflow release.yaml). - [yara\_x-1.23.0.dist-info/sboms/yara-x-py.cyclonedx.json](https://pypi.sbomify.com/artifact/1994ddd3-7308-5d23-a439-846b25308268/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 4 known vulnerabilities ### yara\_x-1.23.0-cp39-abi3-win\_amd64.whl PEP 740 attestation verified (GitHub, VirusTotal/yara-x, workflow release.yaml). - [yara\_x-1.23.0.dist-info/sboms/yara-x-py.cyclonedx.json](https://pypi.sbomify.com/artifact/50477dd2-e7da-5c18-916d-ede7c42e4562/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 4 known vulnerabilities ### yara\_x-1.23.0-pp311-pypy311\_pp80-macosx\_14\_0\_arm64.whl PEP 740 attestation verified (GitHub, VirusTotal/yara-x, workflow release.yaml). - [yara\_x-1.23.0.dist-info/sboms/yara-x-py.cyclonedx.json](https://pypi.sbomify.com/artifact/6c808391-d891-511e-ac33-088c7aff3272/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 4 known vulnerabilities ### yara\_x-1.23.0-pp311-pypy311\_pp80-macosx\_14\_0\_x86\_64.whl PEP 740 attestation verified (GitHub, VirusTotal/yara-x, workflow release.yaml). - [yara\_x-1.23.0.dist-info/sboms/yara-x-py.cyclonedx.json](https://pypi.sbomify.com/artifact/608f6403-4d2a-524b-8dbc-a231a7fc11db/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 4 known vulnerabilities ### yara\_x-1.23.0-pp311-pypy311\_pp80-manylinux\_2\_28\_aarch64.whl PEP 740 attestation verified (GitHub, VirusTotal/yara-x, workflow release.yaml). - [yara\_x-1.23.0.dist-info/sboms/yara-x-py.cyclonedx.json](https://pypi.sbomify.com/artifact/46abc793-1812-5dc5-89e3-7d8774fcc164/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 4 known vulnerabilities ### yara\_x-1.23.0-pp311-pypy311\_pp80-manylinux\_2\_28\_x86\_64.whl PEP 740 attestation verified (GitHub, VirusTotal/yara-x, workflow release.yaml). - [yara\_x-1.23.0.dist-info/sboms/yara-x-py.cyclonedx.json](https://pypi.sbomify.com/artifact/6cd19e12-1787-51a2-a677-8109db4e8240/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 4 known vulnerabilities ### yara\_x-1.23.0-pp311-pypy311\_pp80-win\_amd64.whl PEP 740 attestation verified (GitHub, VirusTotal/yara-x, workflow release.yaml). - [yara\_x-1.23.0.dist-info/sboms/yara-x-py.cyclonedx.json](https://pypi.sbomify.com/artifact/2ec412a3-b5bc-5c41-ae64-f2ac3a2775ea/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 4 known vulnerabilities ## Known vulnerabilities Components listed in these SBOMs, matched against the [OSV database](https://osv.dev/) as of 2026-11-10. | Vulnerability | Severity | Component | Fixed in | Summary | |---|---|---|---|---| | [CVE-2023-49092](https://insights.sbomify.com/CVE-2023-49092/) | medium (5.9) | rsa 0.10.0-rc.19 (crates.io) | 0.10.0 | Marvin Attack: potential key recovery through timing sidechannels | | [RUSTSEC-2025-0141](https://osv.dev/vulnerability/RUSTSEC-2025-0141) | unknown | bincode 2.0.1 (crates.io) | none listed | Bincode is unmaintained | | [RUSTSEC-2026-0387](https://osv.dev/vulnerability/RUSTSEC-2026-0387) | unknown | crypto-bigint 0.7.5 (crates.io) | 0.7.6 | Multiple timing variability issues in operations intended to be constant-time | | [RUSTSEC-2026-0385](https://osv.dev/vulnerability/RUSTSEC-2026-0385) | unknown | ctutils 0.4.3 (crates.io) | 0.4.4 | Non-constant-time mask generation and \`u128\` comparisons | ## Fetch it over TEA This SBOM is served over the [Transparency Exchange API](https://github.com/CycloneDX/transparency-exchange-api) (TEA). With the `libtea` client: ``` pip install libtea python -m libtea https://pypi.sbomify.com pkg:pypi/yara-x@1.23.0 ``` Machine-readable copy of this page: https://pypi.sbomify.com/package/yara-x/1.23.0.json --- From pypi-tea by sbomify: https://pypi.sbomify.com/package/yara-x/1.23.0