Fedora 44 : python-uv-build / rust-ambient-id / rust-astral-reqwest-middleware / etc (2026-b8b59dcf44)

high Nessus Plugin ID 304031

Synopsis

The remote Fedora host is missing one or more security updates.

Description

The remote Fedora 44 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-b8b59dcf44 advisory.

Update `uv` and `python-uv-build` to [0.11.2](https://github.com/astral-sh/uv/blob/0.11.2/CHANGELOG.md).
Version 0.11 includes changes to the networking stack used by `uv`. While its developers think that breakage will be rare, it is possible that these changes will result in the rejection of certificates previously trusted by `uv` so, they have marked the change as breaking out of an abundance of caution. The changes are largely driven by the upgrade of `reqwest`, which powers `uv`'s HTTP clients, to v0.13, which included some breaking changes to TLS certificate verification. This update also includes updates for several of `uv`s Rust library dependencies.

----

Update `rust-openssl-probe` to [0.2.1](https://github.com/rustls/openssl-probe/releases/tag/0.2.1), including breaking changes introduced in [0.2.0](https://github.com/rustls/openssl- probe/releases/tag/0.2.0), and introduce a new `rust-openssl-probe0.1` compat package.

Update `rust-rustls-native-certs` [to 0.8.3](https://github.com/rustls/rustls-native- certs/compare/v/0.8.2...v/0.8.3), now using `openssl-probe` 0.2.

Update `rust-native-tls` [to 0.2.18](https://github.com/rust-native-tls/rust-native- tls/compare/v0.2.15...v0.2.18). Version 0.2.16 added TLS 1.3 as an option, added `stack_from_pem`, and upgraded `openssl-probe` to 0.2. Version 0.2.17 added support for ALPN on the server side. Version 0.2.18 fixed min/max protocol selection fallback for very old OpenSSL versions.

Add an initial package for `rust-webpki-root-certs`.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected packages.

Plugin Details

Severity: High

ID: 304031

File Name: fedora_2026-b8b59dcf44.nasl

Version: 1.1

Type: local

Agent: unix

Family: Fedora Local Security Checks

Published: 3/28/2026

Updated: 3/28/2026

Supported Sensors: Continuous Assessment, Nessus Agent, Nessus

Vulnerability Information

CPE: p-cpe:/a:fedoraproject:fedora:rust-reqsign-aws-v4, p-cpe:/a:fedoraproject:fedora:rust-reqsign, p-cpe:/a:fedoraproject:fedora:rust-openssl-probe, p-cpe:/a:fedoraproject:fedora:rust-reqsign-aliyun-oss, p-cpe:/a:fedoraproject:fedora:rust-reqsign-core, p-cpe:/a:fedoraproject:fedora:rust-ambient-id, p-cpe:/a:fedoraproject:fedora:rust-reqsign-azure-storage, p-cpe:/a:fedoraproject:fedora:rust-astral-reqwest-retry, p-cpe:/a:fedoraproject:fedora:rust-reqsign-command-execute-tokio, p-cpe:/a:fedoraproject:fedora:rust-reqsign-file-read-tokio, p-cpe:/a:fedoraproject:fedora:rust-webpki-root-certs, p-cpe:/a:fedoraproject:fedora:uv, p-cpe:/a:fedoraproject:fedora:rust-rustls-native-certs, p-cpe:/a:fedoraproject:fedora:python-uv-build, p-cpe:/a:fedoraproject:fedora:rust-astral-reqwest-middleware, p-cpe:/a:fedoraproject:fedora:rust-native-tls, p-cpe:/a:fedoraproject:fedora:rust-reqsign-huaweicloud-obs, p-cpe:/a:fedoraproject:fedora:rust-reqsign-google, cpe:/o:fedoraproject:fedora:44, p-cpe:/a:fedoraproject:fedora:rust-reqsign-tencent-cos, p-cpe:/a:fedoraproject:fedora:rust-openssl-probe0.1, p-cpe:/a:fedoraproject:fedora:rust-astral_async_http_range_reader, p-cpe:/a:fedoraproject:fedora:rust-reqsign-http-send-reqwest

Required KB Items: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list

Exploit Ease: No known exploits are available

Patch Publication Date: 3/26/2026

Vulnerability Publication Date: 3/26/2026

Reference Information

FEDORA: 2026-b8b59dcf44

Detections

Analytics