The remote NewStart CGSL host, running version MAIN 7.02, has python-setuptools packages installed that are affected by a vulnerability:

  - setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python     packages. A path traversal vulnerability in `PackageIndex` is present in setuptools prior to version     78.1.1. An attacker would be allowed to write files to arbitrary locations on the filesystem with the     permissions of the process running the Python code, which could escalate to remote code execution     depending on the context. Version 78.1.1 fixes the issue. (CVE-2025-47273)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2025:12834 advisory.

    * setuptools: Path Traversal Vulnerability in setuptools PackageIndex (CVE-2025-47273)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-1746085e78 advisory.

    Security fix for CVE-2025-47273

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2025:11043 advisory.

    * setuptools: Path Traversal Vulnerability in setuptools PackageIndex (CVE-2025-47273)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:11425 advisory.

    Python is an interpreted, interactive, object-oriented programming language, which includes modules,     classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to     many system calls and libraries, as well as to various windowing systems.

    Security Fix(es):

    * setuptools: Path Traversal Vulnerability in setuptools PackageIndex (CVE-2025-47273)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:11464 advisory.

    The fence-agents packages provide a collection of scripts for handling remote power management for cluster     devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster.

    Security Fix(es):

    * setuptools: Path Traversal Vulnerability in setuptools PackageIndex (CVE-2025-47273)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2025:11607 advisory.

    Python is an interpreted, interactive, object-oriented programming language, which includes modules,     classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to     many system calls and libraries, as well as to various windowing systems.

    Security Fix(es):

    * setuptools: Path Traversal Vulnerability in setuptools PackageIndex (CVE-2025-47273)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The CentOS Linux 7 host has a package installed that is affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2025:1757016400 advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-2025_13578 advisory.

    Python is an interpreted, interactive, object-oriented programming language, which includes modules,     classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to     many system calls and libraries, as well as to various windowing systems.

    Python is an interpreted, interactive, object-oriented programming language, which includes modules,     classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to     many system calls and libraries, as well as to various windowing systems.

    Security Fix(es):

    * setuptools: Path Traversal Vulnerability in setuptools PackageIndex (CVE-2025-47273)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-2025_11043 advisory.

    * setuptools: Path Traversal Vulnerability in setuptools PackageIndex (CVE-2025-47273)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of AOS installed on the remote host is prior to 7.0.1.8. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-7.0.1.8 advisory.

  - setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python     packages. A path traversal vulnerability in `PackageIndex` is present in setuptools prior to version     78.1.1. An attacker would be allowed to write files to arbitrary locations on the filesystem with the     permissions of the process running the Python code, which could escalate to remote code execution     depending on the context. Version 78.1.1 fixes the issue. (CVE-2025-47273)

  - inftrees.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging     improper pointer arithmetic. (CVE-2016-9840)

  - A use-after-free vulnerability was found in libxml2. This issue occurs when parsing XPath elements under     certain circumstances when the XML schematron has the <sch:name path=.../> schema elements. This flaw     allows a malicious actor to craft a malicious XML document used as input for libxml, resulting in the     program's crash using libxml or other possible undefined behaviors. (CVE-2025-49794)

  - A vulnerability was found in libxml2. Processing certain sch:name elements from the input XML file can     trigger a memory corruption issue. This flaw allows an attacker to craft a malicious XML input file that     can lead libxml to crash, resulting in a denial of service or other possible undefined behavior due to     sensitive data being corrupted in memory. (CVE-2025-49796)

  - A flaw was found in libxml2's xmlBuildQName function, where integer overflows in buffer size calculations     can lead to a stack-based buffer overflow. This issue can result in memory corruption or a denial of     service when processing crafted input. (CVE-2025-6021)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AHV installed on the remote host is prior to 20230302.103072. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AHV-20230302.103072 advisory.

  - There exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregate terms could     exceed the number of columns available. This could lead to a memory corruption issue. We recommend     upgrading to version 3.50.2 or above. (CVE-2025-6965)

  - LZ4 before 1.9.2 has a heap-based buffer overflow in LZ4_write32 (related to LZ4_compress_destSize),     affecting applications that call LZ4_compress_fast with a large input. (This issue can also lead to data     corruption.) NOTE: the vendor states only a few specific / uncommon usages of the API are at risk.
    (CVE-2019-17543)

  - A use-after-free vulnerability was found in libxml2. This issue occurs when parsing XPath elements under     certain circumstances when the XML schematron has the <sch:name path=.../> schema elements. This flaw     allows a malicious actor to craft a malicious XML document used as input for libxml, resulting in the     program's crash using libxml or other possible undefined behaviors. (CVE-2025-49794)

  - A vulnerability was found in libxml2. Processing certain sch:name elements from the input XML file can     trigger a memory corruption issue. This flaw allows an attacker to craft a malicious XML input file that     can lead libxml to crash, resulting in a denial of service or other possible undefined behavior due to     sensitive data being corrupted in memory. (CVE-2025-49796)

  - A flaw was found in libxml2's xmlBuildQName function, where integer overflows in buffer size calculations     can lead to a stack-based buffer overflow. This issue can result in memory corruption or a denial of     service when processing crafted input. (CVE-2025-6021)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
271289	NewStart CGSL MAIN 7.02 : python-setuptools Vulnerability (NS-SA-2025-0253)	Nessus	NewStart CGSL Local Security Checks	2025/10/24	2025/10/24	high
266574	RockyLinux 9 : python3.12-setuptools (RLSA-2025:12834)	Nessus	Rocky Linux Local Security Checks	2025/10/4	2025/10/4	high
240221	Fedora 41 : python-setuptools (2025-1746085e78)	Nessus	Fedora Local Security Checks	2025/6/21	2025/6/21	high
242179	AlmaLinux 8 : python3.11-setuptools (ALSA-2025:11043)	Nessus	Alma Linux Local Security Checks	2025/7/16	2025/7/16	high
242435	RHEL 8 : python-setuptools (RHSA-2025:11425)	Nessus	Red Hat Local Security Checks	2025/7/21	2025/7/21	high
242478	RHEL 9 : fence-agents (RHSA-2025:11464)	Nessus	Red Hat Local Security Checks	2025/7/21	2025/7/21	high
242644	RHEL 7 : python3-setuptools (RHSA-2025:11607)	Nessus	Red Hat Local Security Checks	2025/7/23	2025/7/23	high
353112	CentOS Linux 7 [TuxCare] Security Update: python3-setuptools (CENTOS7:CLSA-2025:1757016400)	Nessus	CentOS Local Security Checks	2026/9/30	2026/10/1	high
357716	Rocky Linux 9 [CIQ] Security Update: python3.11-setuptools / python3.11-setuptools-wheel (crlsa-2025_13578)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/2	high
358773	Rocky Linux 8 [CIQ] Security Update: python3.11-setuptools / python3.11-setuptools-wheel (crlsa-2025_11043)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/2	high
253514	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-7.0.1.8)	Nessus	Misc.	2025/8/21	2026/5/27	high
269976	Nutanix AHV : Multiple Vulnerabilities (NXSA-AHV-20230302.103072)	Nessus	Misc.	2025/10/10	2025/10/10	high

检测

插件搜索

high

high

high

high

high

high

high

high

high

high

high

high