Detections
Analytics
Alpine: multiple pyc packages: security update to 3.12.16-r0
critical Tenable Cloud Security Plugin ID 477711
Description
There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:- There is a defect in the CPython standard library module “mimetypes” where on Windows the default list of
known file locations are writable meaning other users can create invalid files to cause MemoryError to be
raised on Python runtime startup or have file extensions be interpreted as the incorrect file type. This
defect is caused by the default locations of Linux and macOS platforms (such as “/etc/mime.types”) also
being used on Windows, where they are user-writable locations (“C:\etc\mime.types”). To work-around this
issue a user can call mimetypes.init() with an empty list (“[]”) on Windows platforms to avoid using the
default list of known file locations. (CVE-2024-3220)
- tarfile.tar_filter could be bypassed using crafted link entries, including symlinks with empty or
directory-like names, to redirect later archive members outside the intended extraction directory. This
allowed a malicious tar archive to cause tarfile.extractall() with filter="tar" to write files outside the
destination directory, subject to the permissions of the extracting process. This is the
tarfile.tar_filter counterpart of CVE-2026-7774, which covered tarfile.data_filter. (CVE-2026-114583)
- Python has added a denylist for known compromised certificates to the "ssl" module to ensure user safety
even without certificate revocation configured. Known compromised certificates will automatically be
rejected regardless of the SSLContext policy configuration. (CVE-2026-115557)
Solution
Update the pyc library and its related packages to version 3.12.16-r0 or later.See Also
https://security.alpinelinux.org/vuln/CVE-2024-3220
Plugin Details
Severity: Critical
ID: 477711
Version: Revision 1.1
Type: Local
Published: 10/28/2026
Updated: 10/28/2026
Supported Sensors: Agentless Assessment
Risk Information
VPR
Risk Factor: Medium
Score: 5
Percentile: 92.98
CVSS v2
Risk Factor: Medium
Base Score: 5.8
Temporal Score: 4.3
Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:N
CVSS Score Source: CVE-2026-115557
CVSS v3
Risk Factor: Medium
Base Score: 4.4
Temporal Score: 3.9
Vector: CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
CVSS v4
Risk Factor: Critical
Base Score: 9.4
Threat Score: 7.7
Threat Vector: CVSS:4.0/E:U
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Vulnerability Information
Exploit Ease: No known exploits are available
Vulnerability Publication Date: 2/14/2025