CVE-2025-0938

Medium

Advisory

Published 31 Jan 2025In the index since 5 Sept 2026

Severity: Medium; worst across findings
CVSS: 6.8; base score, highest
EPSS: 0.016; 74th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 561; of 17,787 indexed, latest versions
Container images: 572; deployed by those charts
Fix available: 15 of 15; affected packages

Red Hat Security Advisory: python3.9 security update

Carried by container images the latest versions of 561 of 17,787 indexed charts deploy, on 572 images.

Affected package	Affected versions	Fixed in	Images
python3rpm	3.6.8-15.1.el8, 3.6.8-23.el8, 3.6.8-24.el8_2, 3.6.8-24.el8_2.2+22 more	0:3.6.8-74.el8_10	131
python3.9rpm	3.9.16-1.el9, 3.9.16-1.el9_2.1, 3.9.16-1.el9_2.2, 3.9.18-1.el9_3.1+6 more	0:3.9.21-2.el9	20
python3.11rpm	3.11.7-1.el9, 3.11.7-1.el9_4.5	0:3.11.11-2.el9	2
python3.12rpm	3.12.5-2.el9_5.2	0:3.12.9-1.el9	1
python3.11deb	3.11.0~rc1-1~22.04, 3.11.2-6, 3.11.2-6+deb12u2, 3.11.2-6+deb12u3+2 more	3.11.0~rc1-1~22.04.1~esm3, 3.11.2-6+deb12u6	106
python3.8deb	3.8.5-1~20.04, 3.8.5-1~20.04.2, 3.8.5-1~20.04.3, 3.8.10-0ubuntu1~20.04+10 more	3.8.10-0ubuntu1~20.04.16	96
python3apk	3.11.3-r10, 3.11.4-r0, 3.11.5-r0, 3.11.6-r0+11 more	3.11.12-r0, 3.12.9-r0	59
python2.7deb	2.7.6-8, 2.7.6-8ubuntu0.4, 2.7.12-1ubuntu0~16.04.2, 2.7.12-1ubuntu0~16.04.3+12 more	2.7.6-8ubuntu0.6+esm28, 2.7.12-1ubuntu0~16.04.18+esm16, 2.7.17-1~18.04ubuntu1.13+esm11, 2.7.18-1~20.04.7+esm7+1 more	54
python3.10deb	3.10.4-3, 3.10.4-3ubuntu0.1, 3.10.6-1~22.04, 3.10.6-1~22.04.1+10 more	3.10.12-1~22.04.9	48
python3.6deb	3.6.6-1~18.04, 3.6.7-1~18.04, 3.6.9-1~18.04, 3.6.9-1~18.04ubuntu1+7 more	3.6.9-1~18.04ubuntu1.13+esm4	44
python3.5deb	3.5.2-2ubuntu0~16.04.1, 3.5.2-2ubuntu0~16.04.4, 3.5.2-2ubuntu0~16.04.5, 3.5.2-2ubuntu0~16.04.9	3.5.2-2ubuntu0~16.04.13+esm16	25
python3.12deb	3.12.3-1, 3.12.3-1ubuntu0.1, 3.12.3-1ubuntu0.2, 3.12.3-1ubuntu0.3+1 more	3.12.3-1ubuntu0.5	10
python3.4deb	3.4.0-2ubuntu1, 3.4.3-1ubuntu1~14.04.5, 3.4.3-1ubuntu1~14.04.6, 3.4.3-1ubuntu1~14.04.7	3.4.3-1ubuntu1~14.04.7+esm15	7
pythonbitnami	3.11.11-0, 3.12.8-0	3.9.22	2
python-3.12apk	3.12.0-r1	3.12.9-r0	1

OSV records: ALPINE-CVE-2025-0938 BIT-python-2025-0938 CGA-h8w3-v52w-xgr3 DEBIAN-CVE-2025-0938 RHSA-2025:6977 RHSA-2025:7107 RHSA-2025:7109 RHSA-2026:5588 RLSA-2025:6977 UBUNTU-CVE-2025-0938
Also known as: BIT-libpython-2025-0938, BIT-python-min-2025-0938, CGA-mmh7-3wrq-48mh, PSF-2025-1, USN-7280-1, USN-7280-2, USN-7280-3, USN-7348-1, USN-7348-2

Charts affected

561 by stars

Chart

Latest

Affected images

Radar Score

myweatherhelmwebapp1

1.3.50

1 of 8 See more

myweatherhelm webapp1 1.3.50

1 of the 8 container images this version deploys carry CVE-2025-0938.

Container image	Digest	Package	Fixed in
mcr.microsoft.com/azure-sql-edge :latest	902628a8be89	python3.8@3.8.10-0ubuntu1~20.04.8	3.8.10-0ubuntu1~20.04.16

Open the chart page →

9,225

myweatherhelm-schedulingwebapp1

1.3.92

1 of 9 See more

myweatherhelm-scheduling webapp1 1.3.92

1 of the 9 container images this version deploys carry CVE-2025-0938.

Container image	Digest	Package	Fixed in
mcr.microsoft.com/azure-sql-edge :latest	902628a8be89	python3.8@3.8.10-0ubuntu1~20.04.8	3.8.10-0ubuntu1~20.04.16

Open the chart page →

9,225

webhookiewebhookie

0.1.2

1 of 1 See more

webhookie webhookie 0.1.2

1 of the 1 container images this version deploys carry CVE-2025-0938.

Container image	Digest	Package	Fixed in
hookiesolutions/webhookie :latest	0629694246ba	python3.8@3.8.10-0ubuntu1~20.04.1	3.8.10-0ubuntu1~20.04.16

Open the chart page →

14,420

webhookie-allwebhookie

0.1.2

2 of 3 See more

webhookie-all webhookie 0.1.2

2 of the 3 container images this version deploys carry CVE-2025-0938.

Container image	Digest	Package	Fixed in
hookiesolutions/webhookie :latest	0629694246ba	python3.8@3.8.10-0ubuntu1~20.04.1	3.8.10-0ubuntu1~20.04.16
quay.io/keycloak/keycloak :14.0.0	3029dc0f1d38	python3@3.6.8-37.el8	0:3.6.8-74.el8_10

Open the chart page →

28,699

emissary-ingresswenerme

8.12.2

2 of 2 See more

emissary-ingress wenerme 8.12.2

2 of the 2 container images this version deploys carry CVE-2025-0938.

Container image	Digest	Package	Fixed in
datawire/emissary :3.12.2	1f67a1292d2a	python3@3.11.11-r0	3.11.12-r0
istio/kubectl :1.5.10	dbb7726d1bf0	python3.6@3.6.9-1~18.04ubuntu1.1	3.6.9-1~18.04ubuntu1.13+esm4

Open the chart page →

10,857

longhornwenerme

1.2.3

1 of 2 See more

longhorn wenerme 1.2.3

1 of the 2 container images this version deploys carry CVE-2025-0938.

Container image	Digest	Package	Fixed in
longhornio/longhorn-manager :v1.2.3	dca34321452c	python3.8@3.8.10-0ubuntu1~20.04.2	3.8.10-0ubuntu1~20.04.16

Open the chart page →

15,287

minio-standalonewenerme

1.0.2

1 of 1 See more

minio-standalone wenerme 1.0.2

1 of the 1 container images this version deploys carry CVE-2025-0938.

Container image	Digest	Package	Fixed in
minio/minio :RELEASE.2022-01-04T07-41-07Z	1484c87239ea	python3@3.6.8-41.el8	0:3.6.8-74.el8_10

Open the chart page →

6,138

jaegerwikimedia

3.1.2

1 of 4 See more

jaeger wikimedia 3.1.2

1 of the 4 container images this version deploys carry CVE-2025-0938.

Container image	Digest	Package	Fixed in
jaegertracing/jaeger-cassandra-schema :1.53.0	d48d6dab2c65	python3.10@3.10.12-1~22.04.3	3.10.12-1~22.04.9

Open the chart page →

9,296

playwright-synthetic-monitoringwork-adventure

1.0.1

1 of 1 See more

playwright-synthetic-monitoring work-adventure 1.0.1

1 of the 1 container images this version deploys carry CVE-2025-0938.

Container image	Digest	Package	Fixed in
workadventure/playwright-synthetic-monitoring :main	92b664c2a06f	python3.10@3.10.12-1~22.04.3	3.10.12-1~22.04.9

Open the chart page →

14,172

workshop-pipelinesworkshop-pipelines

0.1.6

1 of 2 See more

workshop-pipelines workshop-pipelines 0.1.6

1 of the 2 container images this version deploys carry CVE-2025-0938.

Container image	Digest	Package	Fixed in
quay.io/maximilianopizarro/workshop-pipelines :latest	e383ba3e0966	python3@3.6.8-41.el8	0:3.6.8-74.el8_10

Open the chart page →

11,592

keycloakxzaks

2.2.0

1 of 1 See more

keycloakx zaks 2.2.0

1 of the 1 container images this version deploys carry CVE-2025-0938.

Container image	Digest	Package	Fixed in
quay.io/keycloak/keycloak :20.0.3	b8f2a453a17a	python3@3.6.8-48.el8_7	0:3.6.8-74.el8_10

Open the chart page →

6,016

Container images carrying it

572 by charts deploying them

A fixed version is listed for 15 of the 15 affected packages.

Container image	Digest	Package	Fixed in	Used by
ghcr.io/k8s-at-home/bazarr :v1.0.3	fdb5501cdfb9	python3.8@3.8.10-0ubuntu1~20.04.2	3.8.10-0ubuntu1~20.04.16	1
ghcr.io/k8s-at-home/haste-server :latest	827aa2f2389d	python3.8@3.8.10-0ubuntu1~20.04	3.8.10-0ubuntu1~20.04.16	1
ghcr.io/k8s-at-home/nzbget :v21.1	e5571acd10ce	python3.10@3.10.4-3ubuntu0.1	3.10.12-1~22.04.9	1
ghcr.io/k8s-at-home/nzbhydra2 :v3.14.2	ef3670f7e0a8	python3.8@3.8.5-1~20.04.2	3.8.10-0ubuntu1~20.04.16	1
ghcr.io/k8s-at-home/prowlarr :v0.3.0.1710	c863aa9875fa	python3.8@3.8.10-0ubuntu1~20.04.4	3.8.10-0ubuntu1~20.04.16	1
ghcr.io/k8s-at-home/qbittorrent :v4.4.2	61deadd1ec78	python3.8@3.8.10-0ubuntu1~20.04.4	3.8.10-0ubuntu1~20.04.16	1
ghcr.io/k8s-at-home/sabnzbd :v3.3.1	c2d6e775db5a	python3.8@3.8.5-1~20.04.3	3.8.10-0ubuntu1~20.04.16	1
ghcr.io/k8s-at-home/tautulli :v2.7.7	4ea617c30397	python3.8@3.8.10-0ubuntu1~20.04.1	3.8.10-0ubuntu1~20.04.16	1
ghcr.io/k8s-at-home/transmission :v3.00	6011182e3946	python3.8@3.8.10-0ubuntu1~20.04.5	3.8.10-0ubuntu1~20.04.16	1
ghcr.io/k8s-at-home/xteve :v2.2.0.200	292b3614670f	python3.8@3.8.10-0ubuntu1~20.04.4	3.8.10-0ubuntu1~20.04.16	1
ghcr.io/kore3lab/kore-board.terminal :v0.5.5	f52e66eff50b	python3.6@3.6.9-1~18.04ubuntu1.9	3.6.9-1~18.04ubuntu1.13+esm4	1
ghcr.io/kvaps/kubefarm-ltsp :v0.13.4	24efef013a53	python3.8@3.8.10-0ubuntu1~20.04.2	3.8.10-0ubuntu1~20.04.16	1
ghcr.io/libreconnect/ferriscompany :0.1.0-rc6	ed86db9f0efe	python3.11@3.11.2-6+deb12u3	3.11.2-6+deb12u6	1
ghcr.io/m0nsterrr/hyperglass :v2.0.4	f7b5d20c5e42	python3@3.12.3-r1	3.12.9-r0	1
ghcr.io/mglants/kea-dhcp :2.5.8	e1b6eb9e37f9	python3@3.11.9-r0	3.11.12-r0	1
ghcr.io/middleware-labs/mw-kube-agent :1.12.0	9c7bc0f9bb35	python3.12@3.12.3-1ubuntu0.3	3.12.3-1ubuntu0.5	1
ghcr.io/mirio/verbacap :v1.5.0	84928e2fc4f2	python3@3.11.9-r0	3.11.12-r0	1
ghcr.io/nefelim4ag/pingdom-operator :0.0.15	f8c7afdcf439	python3.11@3.11.2-6+deb12u2	3.11.2-6+deb12u6	1
ghcr.io/obeone/nfs-server :2.2.3	932f4fa9d0f1	python3@3.11.10-r1	3.11.12-r0	1
ghcr.io/onedr0p/qbittorrent :4.5.2	0efdd8d3ef39	python3@3.11.3-r10	3.11.12-r0	1
ghcr.io/onedr0p/qbittorrent :4.6.3	a4ad890e8c4a	python3@3.11.6-r1	3.11.12-r0	1
ghcr.io/opencost/opencost-parquet-exporter :v0.2.1	ce85ef0ce665	python3.11@3.11.2-6+deb12u5	3.11.2-6+deb12u6	1
ghcr.io/oznu/homebridge :2022-07-08	ff2af53897e7	python2.7@2.7.18-1~20.04.1 python3.8@3.8.10-0ubuntu1~20.04.4	2.7.18-1~20.04.7+esm7 3.8.10-0ubuntu1~20.04.16	1
ghcr.io/plausible/community-edition :v2.1.5	1f9d3fb861e1	python3@3.12.8-r1	3.12.9-r0	1
ghcr.io/plausible/community-edition :v2.1.4	4c2553516d09	python3@3.12.7-r0	3.12.9-r0	1
ghcr.io/projectnessie/nessie :0.92.1	9efe3c74d55f	python3.9@3.9.18-3.el9_4.1	0:3.9.21-2.el9	1
ghcr.io/puckpuck/seashell :1.2	ef5e31333821	python3@3.11.6-r0	3.11.12-r0	1
ghcr.io/sdwbgn/unitycatalog-helm/docker/unitycatalog-ui :0.2.1-5d668c1	ed07e7ca098d	python3.11@3.11.2-6+deb12u5	3.11.2-6+deb12u6	1
ghcr.io/smarter-project/audio-client :v3.1.2	3c8375dc5487	python3.8@3.8.10-0ubuntu1~20.04.5	3.8.10-0ubuntu1~20.04.16	1
ghcr.io/smarter-project/gstreamer :v1.0.2	5ecb16015aa8	python3.8@3.8.10-0ubuntu1~20.04.5	3.8.10-0ubuntu1~20.04.16	1
ghcr.io/smarter-project/image-detector :v2.5.3	1dcca70c6446	python3.8@3.8.10-0ubuntu1~20.04.5	3.8.10-0ubuntu1~20.04.16	1
ghcr.io/streamingfast/substreams-sink-kv :v2.3.0	26953ec68d5d	python3.8@3.8.10-0ubuntu1~20.04.13	3.8.10-0ubuntu1~20.04.16	1
ghcr.io/streamingfast/substreams-sink-noop :v1.4.0	d7c43c3135c6	python3.8@3.8.10-0ubuntu1~20.04.13	3.8.10-0ubuntu1~20.04.16	1
ghcr.io/thoroslives/zilean :v3.10.1	bce6aca0f6ca	python3@3.11.12-r1	3.12.9-r0	1
ghcr.io/topolvm/topolvm-with-sidecar :0.35.0	b354978c440d	python3.10@3.10.12-1~22.04.6	3.10.12-1~22.04.9	1
ghcr.io/wiremind/grafana-pdf-exporter :v1.7	dbaa8527bf4c	python3.11@3.11.2-6	3.11.2-6+deb12u6	1
ghcr.io/wizarrrr/wizarr :4.2.0-beta.3	d19d886d5090	python3.11@3.11.2-6	3.11.2-6+deb12u6	1
ghcr.io/wundergraph/cosmo/otelcollector :0.18.1	5a6fe78d4d15	python3.11@3.11.2-6+deb12u5	3.11.2-6+deb12u6	1
ghcr.io/wyrihaximusnet/redirect :random	bf5983d754d7	python3@3.12.6-r0	3.12.9-r0	1
ghcr.io/zoriya/kyoo_autosync :4.7.1	fbba58ddb1a6	python3.11@3.11.2-6+deb12u4	3.11.2-6+deb12u6	1
ghcr.io/zoriya/kyoo_scanner :4.7.1	7dc0ee57b628	python3.11@3.11.2-6+deb12u4	3.11.2-6+deb12u6	1
mcr.microsoft.com/mssql/server :2017-latest	13221ac5f673	python2.7@2.7.17-1~18.04ubuntu1.11 python3.6@3.6.9-1~18.04ubuntu1.12	2.7.17-1~18.04ubuntu1.13+esm11 3.6.9-1~18.04ubuntu1.13+esm4	1
mcr.microsoft.com/mssql/server :2019-CU16-ubuntu-20.04	49a57dc220b1	python3.8@3.8.10-0ubuntu1~20.04.4	3.8.10-0ubuntu1~20.04.16	1
mcr.microsoft.com/mssql/server :2017-latest	fbf79e0fea59	python2.7@2.7.17-1~18.04ubuntu1.11 python3.6@3.6.9-1~18.04ubuntu1.12	2.7.17-1~18.04ubuntu1.13+esm11 3.6.9-1~18.04ubuntu1.13+esm4	1
public.ecr.aws/jtekt-corporation/image-storage-service :v1.16.17	b1493760c716	python3.11@3.11.2-6+deb12u3	3.11.2-6+deb12u6	1
public.ecr.aws/jtekt-corporation/shinsei-manager :v2.8.1	5cd62142d6ed	python3.11@3.11.2-6	3.11.2-6+deb12u6	1
public.ecr.aws/jtekt-corporation/time-series-storage-service :v1.5.1	046ef5c9ed50	python3.11@3.11.2-6	3.11.2-6+deb12u6	1
public.ecr.aws/perfectscale-io/kube-state-metrics :4.1.14-redhat	849e235e2d3e	python3@3.6.8-67.el8_10	0:3.6.8-74.el8_10	1
public.ecr.aws/perfectscale-io/psc-exporter :v1.0.45-redhat	9083e60c38bc	python3.9@3.9.19-8.el9_5.1	0:3.9.21-2.el9	1
public.ecr.aws/perfectscale-io/ubi9/ubi :9.5	d7c3def9252b	python3.9@3.9.19-8.el9_5.1	0:3.9.21-2.el9	1