CVE-2025-7458 on python3.11 / 3.13

[RaphaelVRossi]

The Debian version Python 3.11 and 3.13 is affected by CVE-2025-7458 because the current version of libsqlite3-0 is 3.40.1-2+deb12u1

Are there any plans to upgrade libsqlite3-0 to 3.41.2 or higher?

It's possible to reproduce the CVE check with:

docker run --rm -v /var/run/docker.sock:/var/run/docker.sock aquasec/trivy image  --format table --exit-code  1 --vuln-type  os,library --severity  CRITICAL,HIGH --timeout  5m0s python:3.13


[...]
├─────────────────────────┼────────────────┼──────────┤              ├─────────────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ libsqlite3-0            │ CVE-2025-6965  │ CRITICAL │              │ 3.40.1-2+deb12u1        │               │ sqlite: Integer Truncation in SQLite                         │
│                         │                │          │              │                         │               │ https://avd.aquasec.com/nvd/cve-2025-6965                    │
│                         ├────────────────┤          │              │                         ├───────────────┼──────────────────────────────────────────────────────────────┤
│                         │ CVE-2025-7458  │          │              │                         │               │ sqlite: SQLite integer overflow                              │
│                         │                │          │              │                         │               │ https://avd.aquasec.com/nvd/cve-2025-7458                    │
├─────────────────────────┼────────────────┤          │              │                         ├───────────────┼──────────────────────────────────────────────────────────────┤
[...]

[tianon]

See https://security-tracker.debian.org/tracker/CVE-2025-7458 (there's not a fix available for Debian Bookworm).

See also https://github.com/docker-library/faq#why-does-my-security-scanner-show-that-an-image-has-cves

[RaphaelVRossi]

@tianon thanks!

Will you know when the Trixie release available? I'm asking because it was possible to "fix" this CVE after this lib was updated to trixie available version

[tianon]

See docker-library/official-images#19661 & https://github.com/docker-library/faq#an-images-source-changed-in-git-now-what