Detections
Analytics

Echo: python3.13: security update to 3.13.5-2+e10

medium Tenable Self-Hosted Container Security Plugin ID 464172

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - When passing data to the b64decode(), standard_b64decode(), and urlsafe_b64decode() functions in the
 "base64" module the characters "+/" will always be accepted, regardless of the value of "altchars"
 parameter, typically used to establish an "alternative base64 alphabet" such as the URL safe alphabet.
 This behavior matches what is recommended in earlier base64 RFCs, but newer RFCs now recommend either
 dropping characters outside the specified base64 alphabet or raising an error. The old behavior has the
 possibility of causing data integrity issues. This behavior can only be insecure if your application uses
 an alternate base64 alphabet (without "+/"). If your application does not use the "altchars" parameter or
 the urlsafe_b64decode() function, then your application does not use an alternative base64 alphabet. The
 attached patches DOES NOT make the base64-decode behavior raise an error, as this would be a change in
 behavior and break existing programs. Instead, the patch deprecates the behavior which will be replaced
 with the newly recommended behavior in a future version of Python. Users are recommended to mitigate by
 verifying user-controlled inputs match the base64 alphabet they are expecting or verify that their
 application would not be affected if the b64decode() functions accepted "+" or "/" outside of altchars.
 (CVE-2025-12781)

Solution

Update the python3.13 library and its related packages to version 3.13.5-2+e10 or later.

See Also

https://advisory.echohq.com/cve/CVE-2025-12781

Plugin Details

Severity: Medium

ID: 464172

Version: Revision 1.1

Type: Local

Published: 10/2/2026

Updated: 10/2/2026

Risk Information

VPR

Risk Factor: Low

Score: 3.9

Percentile: 52.77

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 3.9

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N

CVSS Score Source: CVE-2025-12781

CVSS v3

Risk Factor: Medium

Base Score: 5.3

Temporal Score: 4.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

CVSS v4

Risk Factor: Medium

Base Score: 6.3

Threat Score: 2.9

Threat Vector: CVSS:4.0/E:P

Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 1/23/2026

Vulnerability Publication Date: 1/21/2026

Reference Information

CVE: CVE-2025-12781