Detections
Analytics

Echo: python3.13: security update to 3.13.5-2+e33

medium Tenable Self-Hosted Container Security Plugin ID 463923

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - The HTTPPasswordMgr class in the urllib.request module, along with its subclasses
 HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth, did not take the URL scheme into account
 when matching stored credentials against a requested URL. Credentials added for an https:// URL were also
 used for requests to the same host over http://, so an attacker able to redirect or downgrade a client to
 plain HTTP (for example, via an HTTPS-to-HTTP redirect or an on-path position) could capture credentials
 in cleartext. Credentials added for http:// URLs could likewise be sent over https://. Credential matching
 is now scoped by URL scheme. Credentials registered with a URL that includes a scheme are only used for
 requests with the same scheme. Credentials registered with a bare authority (such as example.com or
 example.com:8080) continue to match any scheme, preserving compatibility with existing code, including
 proxy authentication. Users who cannot upgrade immediately can mitigate by ensuring that applications
 never make plain http:// requests to hosts for which credentials are registered, for example by not
 following redirects to http:// URLs. (CVE-2026-15806)

Solution

Update the python3.13 library and its related packages to version 3.13.5-2+e33 or later.

See Also

https://advisory.echohq.com/cve/CVE-2026-15806

Plugin Details

Severity: Medium

ID: 463923

Version: Revision 1.1

Type: Local

Published: 10/2/2026

Updated: 10/2/2026

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.65

CVSS v2

Risk Factor: Medium

Base Score: 5.4

Temporal Score: 4

Vector: CVSS2#AV:N/AC:H/Au:N/C:C/I:N/A:N

CVSS Score Source: CVE-2026-15806

CVSS v3

Risk Factor: Medium

Base Score: 5.9

Temporal Score: 5.2

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: Medium

Base Score: 6

Threat Score: 2.3

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 8/19/2026

Vulnerability Publication Date: 8/18/2026

Reference Information

CVE: CVE-2026-15806