According to the version of the python packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - The Python standard library HTTP client modules (such     as httplib or urllib) did not perform verification of     TLS/SSL certificates when connecting to HTTPS servers.
    A man-in-the-middle attacker could use this flaw to     hijack connections and eavesdrop or modify transferred     data. (CVE-2014-9365)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2017-1868 advisory.

    - Fix for CVE-2016-1000110 HTTPoxy attack     Resolves: rhbz#1359164
    - Fix for CVE-2016-5636: possible integer overflow and heap corruption in zipimporter.get_data()     Resolves: rhbz#1356364
    - Fix for CVE-2016-0772 python: smtplib StartTLS stripping attack (rhbz#1303647)       Raise an error when STARTTLS fails (upstream patch)
    - Fix for CVE-2016-5699 python: http protocol steam injection attack (rhbz#1303699)       Disabled HTTP header injections in httplib (upstream patch)     Resolves: rhbz#1346357

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of F5 Networks BIG-IP installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the K11068141 advisory.

  - The HTTP clients in the (1) httplib, (2) urllib, (3) urllib2, and (4) xmlrpclib libraries in CPython (aka     Python) 2.x before 2.7.9 and 3.x before 3.4.3, when accessing an HTTPS URL, do not (a) check the     certificate against a trust store or verify that the server hostname matches a domain name in the     subject's (b) Common Name or (c) subjectAltName field of the X.509 certificate, which allows man-in-the-     middle attackers to spoof SSL servers via an arbitrary valid certificate. (CVE-2014-9365)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Scientific Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the SLSA-2015:2101-1 advisory.

  - The gzip_decode function in the xmlrpc client library in Python 3.4 and earlier allows remote attackers to     cause a denial of service (memory consumption) via a crafted HTTP request. (CVE-2013-1753)

  - Array index error in the scanstring function in the _json module in Python 2.7 through 3.5 and simplejson     before 2.6.1 allows context-dependent attackers to read arbitrary process memory via a negative index     value in the idx argument to the raw_decode function. (CVE-2014-4616)

  - The CGIHTTPServer module in Python 2.7.5 and 3.3.4 does not properly handle URLs in which URL encoding is     used for path separators, which allows remote attackers to read script source code or conduct directory     traversal attacks and execute unintended code via a crafted character sequence, as demonstrated by a %2f     separator. (CVE-2014-4650)

  - Integer overflow in bufferobject.c in Python before 2.7.8 allows context-dependent attackers to obtain     sensitive information from process memory via a large size and offset in a buffer function.
    (CVE-2014-7185)

  - The HTTP clients in the (1) httplib, (2) urllib, (3) urllib2, and (4) xmlrpclib libraries in CPython (aka     Python) 2.x before 2.7.9 and 3.x before 3.4.3, when accessing an HTTPS URL, do not (a) check the     certificate against a trust store or verify that the server hostname matches a domain name in the     subject's (b) Common Name or (c) subjectAltName field of the X.509 certificate, which allows man-in-the-     middle attackers to spoof SSL servers via an arbitrary valid certificate. (CVE-2014-9365)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It was discovered that multiple Python standard library modules implementing network protocols (such as httplib or smtplib) failed to restrict sizes of server responses. A malicious server could cause a client using one of the affected modules to consume an excessive amount of memory.(CVE-2013-1752)

It was discovered that the Python xmlrpclib did not restrict the size of a gzip compressed HTTP responses. A malicious XMLRPC server could cause an XMLRPC client using xmlrpclib to consume an excessive amount of memory. (CVE-2013-1753)

The Python standard library HTTP client modules (such as httplib or urllib) did not perform verification of TLS/SSL certificates when connecting to HTTPS servers. A man-in-the-middle attacker could use this flaw to hijack connections and eavesdrop or modify transferred data.(CVE-2014-9365)

According to the versions of the python packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - It was found that Python's smtplib library did not     return an exception when StartTLS failed to be     established in the SMTP.starttls() function. A man in     the middle attacker could strip out the STARTTLS     command without generating an exception on the Python     SMTP client application, preventing the establishment     of the TLS layer.(CVE-2016-0772)

  - A vulnerability was discovered in Python, in the     built-in zipimporter. A specially crafted zip file     placed in a module path such that it would be loaded by     a later 'import' statement could cause a heap overflow,     leading to arbitrary code execution.(CVE-2016-5636)

  - A flaw was found in the way the DES/3DES cipher was     used as part of the TLS/SSL protocol. A     man-in-the-middle attacker could use this flaw to     recover some plaintext data by capturing large amounts     of encrypted traffic between TLS/SSL server and client     if the communication used a DES/3DES based     ciphersuite.(CVE-2016-2183)

  - The Python standard library HTTP client modules (such     as httplib or urllib) did not perform verification of     TLS/SSL certificates when connecting to HTTPS servers.
    A man-in-the-middle attacker could use this flaw to     hijack connections and eavesdrop or modify transferred     data.(CVE-2014-9365)

  - An integer overflow flaw was found in the way the     buffer() function handled its offset and size     arguments. An attacker able to control those arguments     could use this flaw to disclose portions of the     application memory or cause it to crash.(CVE-2014-7185)

  - A flaw was found in the way catastrophic backtracking     was implemented in python's pop3lib's apop() method. An     attacker could use this flaw to cause denial of     service.(CVE-2018-1060)

  - The ssl.match_hostname function in the SSL module in     Python 2.6 through 3.4 does not properly handle a '\\0'     character in a domain name in the Subject Alternative     Name field of an X.509 certificate, which allows     man-in-the-middle attackers to spoof arbitrary SSL     servers via a crafted certificate issued by a     legitimate Certification Authority, a related issue to     CVE-2009-2408.(CVE-2013-4238)

  - It was found that the Python's httplib library (used by     urllib, urllib2 and others) did not properly check     HTTPConnection.putheader() function arguments. An     attacker could use this flaw to inject additional     headers in a Python application that allowed user     provided header names or values.(CVE-2016-5699)

  - CPython (aka Python) up to 2.7.13 is vulnerable to an     integer overflow in the PyString_DecodeEscape function     in stringobject.c, resulting in heap-based buffer     overflow (and possible arbitrary code     execution)(CVE-2017-1000158)

  - A flaw was found in the way catastrophic backtracking     was implemented in python's difflib.IS_LINE_JUNK     method. An attacker could use this flaw to cause denial     of service.(CVE-2018-1061)

  - It was discovered that multiple Python standard library     modules implementing network protocols (such as httplib     or smtplib) failed to restrict sizes of server     responses. A malicious server could cause a client     using one of the affected modules to consume an     excessive amount of memory.(CVE-2013-1752)

  - A flaw was found in the way the json module handled     negative index argument passed to certain functions     (such as raw_decode()). An attacker able to control     index value passed to one of the affected functions     could possibly use this flaw to disclose portions of     the application memory.(CVE-2014-4616)

  - urllib in Python 2.x through 2.7.16 supports the     local_file: scheme, which makes it easier for remote     attackers to bypass protection mechanisms that     blacklist file: URIs, as demonstrated by triggering a     urllib.urlopen('local_file:///etc/passwd')     call.(CVE-2019-9948)

  - Python's elementtree C accelerator failed to initialise     Expat's hash salt during initialization. This could     make it easy to conduct denial of service attacks     against Expat by contructing an XML document that would     cause pathological hash collisions in Expat's internal     data structures, consuming large amounts CPU and     RAM.(CVE-2018-14647)

  - A null pointer dereference vulnerability was found in     the certificate parsing code in Python. This causes a     denial of service to applications when parsing     specially crafted certificates. This vulnerability is     unlikely to be triggered if application enables SSL/TLS     certificate validation and accepts certificates only     from trusted root certificate     authorities.(CVE-2019-5010)

  - Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is     affected by: Improper Handling of Unicode Encoding     (with an incorrect netloc) during NFKC normalization.
    The impact is: Information disclosure (credentials,     cookies, etc. that are cached against a given     hostname). The components are: urllib.parse.urlsplit,     urllib.parse.urlparse. The attack vector is: A     specially crafted URL could be incorrectly parsed to     locate cookies or authentication data and send that     information to a different host than when parsed     correctly.(CVE-2019-9636)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The HTTP clients in the (1) httplib, (2) urllib, (3) urllib2, and (4) xmlrpclib libraries in CPython (aka     Python) 2.x before 2.7.9 and 3.x before 3.4.3, when accessing an HTTPS URL, do not (a) check the     certificate against a trust store or verify that the server hostname matches a domain name in the     subject's (b) Common Name or (c) subjectAltName field of the X.509 certificate, which allows man-in-the-     middle attackers to spoof SSL servers via an arbitrary valid certificate. (CVE-2014-9365)

Note that Nessus relies on the presence of the package as reported by the vendor.

An update for python is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es) :

* The Python standard library HTTP client modules (such as httplib or urllib) did not perform verification of TLS/SSL certificates when connecting to HTTPS servers. A man-in-the-middle attacker could use this flaw to hijack connections and eavesdrop or modify transferred data. (CVE-2014-9365)

Note: The Python standard library was updated to enable certificate verification by default. Refer to the Knowledgebase article 2039753 linked to in the References section for further details about this change. (BZ#1219110)

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.4 Release Notes linked from the References section.

The remote MiracleLinux 4 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2017-1647:01 advisory.

    python27-mod_wsgi     The mod_wsgi adapter is an Apache module that provides a WSGI compliant     interface for hosting Python based web applications within Apache. The     adapter is written completely in C code against the Apache C runtime and     for hosting WSGI applications within Apache has a lower overhead than using     existing WSGI adapters for mod_python or CGI.
    python27-python     Python is an interpreted, interactive, object-oriented programming     language often compared to Tcl, Perl, Scheme or Java. Python includes     modules, classes, exceptions, very high level dynamic data types and     dynamic typing. Python supports interfaces to many system calls and     libraries, as well as to various windowing systems (X11, Motif, Tk,     Mac and MFC).
    Programmers can write new built-in modules for Python in C or C  .
    Python can be used as an extension language for applications that need     a programmable interface.
    Note that documentation for Python is provided in the python-docs     package.
    This package provides the python executable; most of the actual     implementation is within the python-libs package.
    python27-python-coverage     Coverage.py is a Python module that measures code coverage during Python     execution. It uses the code analysis tools and tracing hooks provided in the     Python standard library to determine which lines are executable, and which     have been executed.
    python27-python-pip     Pip is a replacement for `easy_install     <http://peak.telecommunity.com/DevCenter/EasyInstall>`_.  It uses mostly the     same techniques for finding packages, so packages that were made     easy_installable should be pip-installable as well.
    python27-python-setuptools     Setuptools is a collection of enhancements to the Python distutils that allow     you to more easily build and distribute Python packages, especially ones that     have dependencies on other packages.
    This package contains the runtime components of setuptools, necessary to     execute the software that requires pkg_resources.py.
    This package contains the distribute fork of setuptools.
    python27-python-virtualenv     virtualenv is a tool to create isolated Python environments. virtualenv     is a successor to workingenv, and an extension of virtual-python. It is     written by Ian Bicking, and sponsored by the Open Planning Project. It is     licensed under an MIT-style permissive license.
    Security issues fixed with this release:
    CVE-2014-9365     The HTTP clients in the (1) httplib, (2) urllib, (3) urllib2, and (4)     xmlrpclib libraries in CPython (aka Python) 2.x before 2.7.9 and 3.x     before 3.4.3, when accessing an HTTPS URL, do not (a) check the     certificate against a trust store or verify that the server hostname     matches a domain name in the subject's (b) Common Name or (c)     subjectAltName field of the X.509 certificate, which allows     man-in-the-middle attackers to spoof SSL servers via an arbitrary     valid certificate.
    Security Fix(es) in the python27-python component:

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2017:1162 advisory.

    Python is an interpreted, interactive, object-oriented programming language that supports modules,     classes, exceptions, high-level dynamic data types, and dynamic typing. The python27 packages provide a     stable release of Python 2.7 with a number of additional utilities and database connectors for MySQL and     PostgreSQL.

    The python27 Software Collection has been upgraded to version 2.7.13, which provides a number of bug fixes     and enhancements over the previous version. For detailed changes, see the Red Hat Software Collections 2.4     Release Notes linked from the References section. (BZ#1402809, BZ#1344674, BZ#1413063)

    Security Fix(es) in the python27-python component:

    * The Python standard library HTTP client modules (such as httplib or urllib) did not perform verification     of TLS/SSL certificates when connecting to HTTPS servers. A man-in-the-middle attacker could use this flaw     to hijack connections and eavesdrop or modify transferred data. (CVE-2014-9365)

    Note: The Python standard library was updated to enable certificate verification by default. Refer to the     Knowledgebase article 2039753 linked to in the References section for further details about this change.
    (BZ#1417838)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
103023	EulerOS 2.0 SP1 : python (EulerOS-SA-2017-1185)	Nessus	Huawei Local Security Checks	2017/9/8	2025/11/24	medium
102286	Oracle Linux 7 : python (ELSA-2017-1868)	Nessus	Oracle Linux Local Security Checks	2017/8/9	2025/12/2	critical
184227	F5 Networks BIG-IP : Python vulnerability (K11068141)	Nessus	F5 Networks Local Security Checks	2023/11/2	2024/5/7	medium
87570	Scientific Linux Security Update : python on 7.x i686/x86_64 (2015:2101)	Nessus	Scientific Linux Local Security Checks	2015/12/22	2025/8/29	critical
84369	Amazon Linux AMI : python27 (ALAS-2015-552)	Nessus	Amazon Linux Local Security Checks	2015/6/25	2020/3/12	high
124937	EulerOS Virtualization 3.0.1.0 : python (EulerOS-SA-2019-1434)	Nessus	Huawei Local Security Checks	2019/5/14	2024/5/23	critical
218528	Linux Distros Unpatched Vulnerability : CVE-2014-9365	Nessus	Misc.	2025/3/4	2026/8/4	critical
102741	CentOS 7 : python (CESA-2017:1868)	Nessus	CentOS Local Security Checks	2017/8/25	2025/11/25	medium
289411	MiracleLinux 4 : [security - medium] python27 (AXSA:2017-1647:01)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/19	critical
210153	RHEL 6 / 7 : python27 (RHSA-2017:1162)	Nessus	Red Hat Local Security Checks	2024/11/4	2025/4/15	critical

检测

插件搜索

medium

critical

medium

critical

high

critical

critical

medium

critical

critical