Detections
Analytics

Echo: python3.13: security update to 3.13.5-2+e39

high Tenable Cloud Security Plugin ID 472788

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - ssl.SSLContext.wrap_bio() didn't require the server_hostname argument to not be None if
 ssl.SSLContext.check_hostname was set. Due to a missing parameter check in SSLObject, if the
 server_hostname argument isn't supplied then hostname verification would be silently skipped. This defect
 could lead to programs where certificate hostname verification *appeared* to be succeeding with
 SSLContext.check_hostname = True and no ValueError being raised due to misconfiguration. If the program
 passes a server_hostname value that isn't an empty string or None to any of these APIs then certificate
 hostname verification proceeds as expected and the program is not affected by this vulnerability.
 Mitigating this vulnerability doesn't require updating Python or applying the patch. To mitigate, pass a
 valid non-None and non-empty server_hostname value to SSLContext.wrap_bio(), asyncio.create_connection(),
 or asyncio.loop.start_tls() and certificate hostname verification will proceed as expected. Upgrading to
 the latest version of Python or applying the patch only changes the behavior from silently skipping
 hostname verification to raising a ValueError, similar to SSLContext.wrap_socket(), when server_hostname
 isn't supplied. (CVE-2026-19553)

Solution

Update the python3.13 library and its related packages to version 3.13.5-2+e39 or later.

See Also

https://advisory.echohq.com/cve/CVE-2026-19553

Plugin Details

Severity: High

ID: 472788

Version: Revision 1.1

Type: Local

Published: 10/5/2026

Updated: 10/5/2026

Risk Information

VPR

Risk Factor: Medium

Score: 6.3

Percentile: 96.3

CVSS v2

Risk Factor: Medium

Base Score: 6.4

Temporal Score: 4.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N

CVSS Score Source: CVE-2026-19553

CVSS v3

Risk Factor: Medium

Base Score: 5.9

Temporal Score: 5.2

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: High

Base Score: 7.6

Threat Score: 4.9

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 10/1/2026

Vulnerability Publication Date: 8/20/2026

Reference Information

CVE: CVE-2026-19553