Detections
Analytics

Echo: python-3.13: security update to 3.13.4-e0python3.11: security update to 3.11.2-6+deb12u3

medium Tenable Self-Hosted Container Security Plugin ID 458432

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Allows modifying some file metadata (e.g. last modified) with filter="data" or file permissions (chmod)
 with filter="tar" of files outside the extraction directory. You are affected by this vulnerability if
 using the tarfile module to extract untrusted tar archives using TarFile.extractall() or TarFile.extract()
 using the filter= parameter with a value of "data" or "tar". See the tarfile extraction filters
 documentation https://docs.python.org/3/library/tarfile.html#tarfile-extraction-filter for more
 information. Only Python versions 3.12 or later are affected by these vulnerabilities, earlier versions
 don't include the extraction filter feature. Note that for Python 3.14 or later the default value of
 filter= changed from "no filtering" to `"data", so if you are relying on this new default behavior then
 your usage is also affected. Note that none of these vulnerabilities significantly affect the installation
 of source distributions which are tar archives as source distributions already allow arbitrary code
 execution during the build process. However when evaluating source distributions it's important to avoid
 installing source distributions with suspicious links. (CVE-2024-12718)

Solution

Update the python3.11 library and its related packages to version 3.11.2-6+deb12u3 or later.

See Also

https://advisory.echohq.com/cve/CVE-2024-12718

Plugin Details

Severity: Medium

ID: 458432

Version: Revision 1.2

Type: Local

Published: 10/2/2026

Updated: 10/5/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3.2

Percentile: 51.14

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 3.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N

CVSS Score Source: CVE-2024-12718

CVSS v3

Risk Factor: Medium

Base Score: 5.3

Temporal Score: 4.6

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 9/15/2025

Vulnerability Publication Date: 9/15/2025

Reference Information

CVE: CVE-2024-12718