Detections
Analytics

Echo: pip: security update to 25.2+echo.1python-pip: security update to 25.2+dfsg-1+e1

medium Tenable Cloud Security Plugin ID 465763

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - When extracting a tar archive pip may not check symbolic links point into the extraction directory if the
 tarfile module doesn't implement PEP 706. Note that upgrading pip to a "fixed" version for this
 vulnerability doesn't fix all known vulnerabilities that are remediated by using a Python version that
 implements PEP 706. Note that this is a vulnerability in pip's fallback implementation of tar extraction
 for Python versions that don't implement PEP 706 and therefore are not secure to all vulnerabilities in
 the Python 'tarfile' module. If you're using a Python version that implements PEP 706 then pip doesn't use
 the "vulnerable" fallback code. Mitigations include upgrading to a version of pip that includes the fix,
 upgrading to a Python version that implements PEP 706 (Python >=3.9.17, >=3.10.12, >=3.11.4, or >=3.12),
 applying the linked patch, or inspecting source distributions (sdists) before installation as is already a
 best-practice. (CVE-2025-8869)

Solution

Update the python-pip library and its related packages to version 25.2+dfsg-1+e1 or later.

See Also

https://advisory.echohq.com/cve/CVE-2025-8869

Plugin Details

Severity: Medium

ID: 465763

Version: Revision 1.1

Type: Local

Published: 10/2/2026

Updated: 10/3/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.76

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 5.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:C/A:N

CVSS Score Source: CVE-2025-8869

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: Medium

Base Score: 5.9

Threat Score: 2.1

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 9/25/2025

Vulnerability Publication Date: 9/24/2025

Reference Information

CVE: CVE-2025-8869