Detections
Analytics

Echo: python-3.13: security update to 3.13.4-e0python3.11: security update to 3.11.2-6+deb12u3

critical Tenable Cloud Security Plugin ID 457199

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Allows arbitrary filesystem writes outside the extraction directory during extraction with filter="data".
 You are affected by this vulnerability if using the tarfile module to extract untrusted tar archives using
 TarFile.extractall() or TarFile.extract() using the filter= parameter with a value of "data" or "tar". See
 the tarfile extraction filters documentation https://docs.python.org/3/library/tarfile.html#tarfile-
 extraction-filter for more information. Note that for Python 3.14 or later the default value of filter=
 changed from "no filtering" to `"data", so if you are relying on this new default behavior then your usage
 is also affected. Note that none of these vulnerabilities significantly affect the installation of source
 distributions which are tar archives as source distributions already allow arbitrary code execution during
 the build process. However when evaluating source distributions it's important to avoid installing source
 distributions with suspicious links. (CVE-2025-4517)

Solution

Update the python3.11 library and its related packages to version 3.11.2-6+deb12u3 or later.

See Also

https://advisory.echohq.com/cve/CVE-2025-4517

Plugin Details

Severity: Critical

ID: 457199

Version: Revision 1.2

Type: Local

Published: 10/2/2026

Updated: 10/2/2026

Risk Information

VPR

Risk Factor: High

Score: 7.2

Percentile: 98.22

CVSS v2

Risk Factor: High

Base Score: 9.7

Temporal Score: 7.6

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:P

CVSS Score Source: CVE-2025-4517

CVSS v3

Risk Factor: Critical

Base Score: 9.4

Temporal Score: 8.4

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 9/15/2025

Vulnerability Publication Date: 9/15/2025

Reference Information

CVE: CVE-2025-4517