Hello all.I could use some enlightenment on debsecan as I am not quite understanding it's results recently. Things were reporting as I expected (via my having read the MAN page and other discussions of the tool) until just a couple weeks ago when this behavior seems to have changed.
I run periodic healthchecks via the check_debsecan wrapper/healthcheck on a collection of nodes running trixie.
Despite having apt update && apt upgrade'd all packages on these systems (just prior to drafting this message), I continue receiving output from debsecan reporting vulnerabilities despite having what I believe are the fixed versions upgraded/installed.
ex> ===[ debsecan --suite trixie --only-fixed --format detail | less ]======= CVE-2025-11468 (*fixed*)When folding a long comment in an email header containing exclusively ...
*installed*: libpython3.13 *3.13.5-2+deb13u4* (built from python3.13 3.13.5-2+deb13u4) fixed in unstable: python3.13 3.13.12-1 (source package) fixed on branch: python3.13 3.13.5-2+deb13u1 (source package) fixed on branch: python3.13 3.13.5-2+deb13u2 (source package) fixed on branch: python3.13 3.13.5-2+deb13u3 (source package) * fix is available for the selected suite (trixie)* ==========Debsecan is flagging this package as having a CVE assigned and that a fix is potentially available.
I have read the related CVE page as well. [ https://security-tracker.debian.org/tracker/CVE-2025-11468 ]The CVE page also states that for trixie, python3.13 has the fix applied in the version:
===== *3.13.5-2+deb13u3** * When I query what is currently installed, I see the following: ===[ apt list --installed | fgrep python3.13 ]=======WARNING: apt does not have a stable CLI interface. Use with caution in scripts.
libpython3.13-minimal/stable-updates,now *3.13.5-2+deb13u4* amd64 [installed,automatic] libpython3.13-stdlib/stable-updates,now *3.13.5-2+deb13u4* amd64 [installed,automatic] libpython3.13/stable-updates,now *3.13.5-2+deb13u4* amd64 [installed,automatic] python3.13-minimal/stable-updates,now *3.13.5-2+deb13u4* amd64 [installed,automatic]
python3.13/stable-updates,now *3.13.5-2+deb13u4* amd64 [installed,automatic] ==========Should I not be assuming/understanding that *u4* is newer than *u3* and thus has the fix implemented/included? or are the reported 'fixed' version explicitly ONLY the listed *u3* version?
Has this behavior recently changed? Up until a couple weeks ago, when I would upgrade packages reporting fixes to the newest version available, debsecan would stop complaining about the package having a fix available that I still needed to install.
Thank you in advance for any $CLUE++ anyone can provide. Cheers, -Chris -- Node-Nine, Inc. [email protected] 619.354.6463
OpenPGP_0xE3B7ECCE88761F0D.asc
Description: OpenPGP public key
OpenPGP_signature.asc
Description: OpenPGP digital signature
