Question re: debsecan

Chris Moody <[email protected]> Mon, 24 Aug 2026 16:40:58 -0700
Newsgroups	gmane.linux.debian.user
Message-ID	<[email protected]>
Hello all.

I could use some enlightenment on debsecan as I am not quite 
understanding it's results recently.  Things were reporting as I 
expected (via my having read the MAN page and other discussions of the 
tool) until just a couple weeks ago when this behavior seems to have 
changed.

I run periodic healthchecks via the check_debsecan wrapper/healthcheck 
on a collection of nodes running trixie.

Despite having apt update && apt upgrade'd all packages on these systems 
(just prior to drafting this message), I continue receiving output from 
debsecan reporting vulnerabilities despite having what I believe are the 
fixed versions upgraded/installed.

ex>
===[  debsecan --suite trixie --only-fixed --format detail | less ]=======
CVE-2025-11468 (*fixed*)
   When folding a long comment in an email header containing 
exclusively  ...
*installed*: libpython3.13 *3.13.5-2+deb13u4*
              (built from python3.13 3.13.5-2+deb13u4)
   fixed in unstable: python3.13 3.13.12-1 (source package)
   fixed on branch:   python3.13 3.13.5-2+deb13u1 (source package)
   fixed on branch:   python3.13 3.13.5-2+deb13u2 (source package)
   fixed on branch:   python3.13 3.13.5-2+deb13u3 (source package)
*  fix is available for the selected suite (trixie)*
==========

Debsecan is flagging this package as having a CVE assigned and that a 
fix is potentially available.

I have read the related CVE page as well.
[ https://security-tracker.debian.org/tracker/CVE-2025-11468 ]

The CVE page also states that for trixie, python3.13 has the fix applied 
in the version:
=====
*3.13.5-2+deb13u3**
*


When I query what is currently installed, I see the following:
===[ apt list --installed | fgrep python3.13 ]=======
WARNING: apt does not have a stable CLI interface. Use with caution in 
scripts.

libpython3.13-minimal/stable-updates,now *3.13.5-2+deb13u4* amd64 
[installed,automatic]
libpython3.13-stdlib/stable-updates,now *3.13.5-2+deb13u4* amd64 
[installed,automatic]
libpython3.13/stable-updates,now *3.13.5-2+deb13u4* amd64 
[installed,automatic]
python3.13-minimal/stable-updates,now *3.13.5-2+deb13u4* amd64 
[installed,automatic]
python3.13/stable-updates,now *3.13.5-2+deb13u4* amd64 [installed,automatic]
==========

Should I not be assuming/understanding that *u4* is newer than *u3* and 
thus has the fix implemented/included?  or are the reported 'fixed' 
version explicitly ONLY the listed *u3* version?

Has this behavior recently changed?  Up until a couple weeks ago, when I 
would upgrade packages reporting fixes to the newest version available, 
debsecan would stop complaining about the package having a fix available 
that I still needed to install.

Thank you in advance for any $CLUE++ anyone can provide.

Cheers,
-Chris

-- 
Node-Nine, Inc.
[email protected]
619.354.6463
OpenPGP_0xE3B7ECCE88761F0D.asc (application/pgp-keys, 2.6 KB)
OpenPGP_signature.asc (application/pgp-signature, 495 B)