It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1964 advisory.

    The tarfile module would still apply normalization of AREGTYPE (\x00) blocks to DIRTYPE, even while     processing a multi-block member such as GNUTYPE_LONGNAME or GNUTYPE_LONGLINK. This could result in a     crafted tar archive being misinterpreted by the tarfile module compared to other implementations.
    (CVE-2025-13462)

    When using the configparser module to write configuration filescontaining multi-line text values with     carriage return characters (\r) theresulting file could be injected with unexpected keys and values if     theattacker controls the written value. (CVE-2026-0864)

    When using the tarfile module with a file opened in streaming mode (mode=r|) the tarfile module did     not properly handle EOF, making archive parsing take exponentially longer. (CVE-2026-11972)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3635-1 advisory.

    - CVE-2026-0864: improper handling of line-ending characters can lead to configuration file injection when     the       `configparser` module is used (bsc#1269066).
    - CVE-2026-1703: files may be extracted outside the installation directory when installing and extracting     maliciously       crafted wheel archives (bsc#1257599).
    - CVE-2026-3219: python-pip: pip doesn't reject concatenated ZIP (bsc#1262467).
    - CVE-2026-3276: quadratic complexity in `unicodedata.normalize()` can lead to DoS when processing     specially crafted       Unicode input (bsc#1267581).
    - CVE-2026-6357: pip self-update functionality can import newly installed modules after wheel installation     (bsc#1263442       bsc#1263443).
    - CVE-2026-7210: `xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-     flooding       protection (bsc#1264962).
    - CVE-2026-8328: `ftpcp()` does not use actual peer address and trusts server-supplied PASV host address     (bsc#1265268).
    - CVE-2026-8643: Path traversal via malicious entry point name in pip wheel installation allows arbitrary     file overwrite       (bsc#1266669).
    - CVE-2026-11972: infinite loop due to improper EOF handling in the tarfile module streaming mode can lead     to DoS       (bsc#1269788).
    - CVE-2026-15308: Incremental HTMLParser allows CPU-exhaustion DoS via repeated unterminated markup     declarations       (bsc#1271192).
    - Regression in `http.cookies` (bsc#1263083).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1963 advisory.

    When using the configparser module to write configuration filescontaining multi-line text values with     carriage return characters (\r) theresulting file could be injected with unexpected keys and values if     theattacker controls the written value. (CVE-2026-0864)

    tarfile.extractall() with the 'data' or 'tar'filter could be bypassed by a crafted archive where a     hardlinkreferences a symlink stored at a deeper name than the hardlink itself.The extraction fallback     validated the symlink at it's archived locationbut recreated it at the hardlink's shallowerpath, letting a     relativetarget the filter judged contained escape the destination directory.This allowed a malicious tar     archive to create a symlink pointingoutside the destination, enabling out-of-destination file reads     orwrites. This was an incomplete fix of CVE-2025-4330. (CVE-2026-11940)

    When using the tarfile module with a file opened in streaming mode (mode=r|) the tarfile module did     not properly handle EOF, making archive parsing take exponentially longer. (CVE-2026-11972)

    unicodedata.normalize() can take excessive CPU time when processing specially crafted Unicode input     containing long runs of combining characters with alternating Canonical Combining Class values. This     affects all normalization forms. (CVE-2026-3276)

    bz2.BZ2Decompressor objects could be reused after a decompression error. If an application caught the     resulting OSError and retried with the same decompressor, crafted input could cause the decompressor to     resume from an invalid internal state and perform out-of-bounds writes to a stack buffer. This could crash     the process when processing untrusted data. (CVE-2026-9669)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3548-1 advisory.

    Security issues fixed:

    - CVE-2026-0864: improper handling of line-ending characters can lead to configuration file injection when     the       `configparser` module is used (bsc#1269066).
    - CVE-2026-3276: quadratic complexity in `unicodedata.normalize()` can lead to DoS when processing     specially crafted       Unicode input (bsc#1267581).
    - CVE-2026-4360: in the `Tarfile.extract()` function, the filter parameter is not passed properly when     extracting       hardlinks (bsc#1269959).
    - CVE-2026-7210: `xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-     flooding       protection (bsc#1264962).
    - CVE-2026-7774: `tarfile.data_filter` path traversal bypass allows writing outside the extraction     directory       (bsc#1267821).
    - CVE-2026-8328: `ftpcp()` does not use actual peer address and trusts server-supplied PASV host address     (bsc#1265268).
    - CVE-2026-11940: tarfile extraction filter bypass via a crafted archive allows escaping the destination     directory and       enables arbitrary file reads and writes (bsc#1268977).
    - CVE-2026-11972: infinite loop due to improper EOF handling in the tarfile module streaming mode can lead     to DoS       (bsc#1269788).
    - CVE-2026-15308: incremental `HTMLParser` allows CPU-exhaustion DoS via repeated unterminated markup     declarations       (bsc#1271192).

    Non security issue fixed:

    - Improve testing for the support of `IPPROTO_UDPLITE`, which could be not present although header files     are       (bsc#1268375).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21595-1 advisory.

    - CVE-2025-15366: user-controlled command can allow additional commands injected using newlines     (bsc#1257044).
    - CVE-2025-15367: control characters may allow the injection of additional commands (bsc#1257041).
    - CVE-2026-0864: improper handling of line-ending characters can lead to configuration file injection when     the       `configparser` module is used (bsc#1269066).
    - CVE-2026-4360: in the Tarfile.extract() function, the filter parameter is not passed properly when     extracting       hardlinks (bsc#1269959).
    - CVE-2026-8328: `ftpcp()` does not use actual peer address and trusts server-supplied PASV host address     (bsc#1265268).
    - CVE-2026-11940: tarfile extraction filter bypass via a crafted archive allows escaping the destination     directory and       enables arbitrary file reads and writes (bsc#1268977).
    - CVE-2026-11972: infinite loop due to improper EOF handling in the tarfile module streaming mode can lead     to DoS       (bsc#1269788).
    - CVE-2026-15308: Incremental HTMLParser allows CPU-exhaustion DoS via repeated unterminated markup     declarations       (bsc#1271192).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
328491	Amazon Linux 2023 : python3.13, python3.13-devel, python3.13-freethreading (ALAS2023-2026-1964)	Nessus	Amazon Linux Local Security Checks	2026/7/20	2026/8/24	high
337990	SUSE SLES15: libpython2_7-1_0 / python / python-base / python-curses / etc (SUSE-SU-2026:3635-1)	Nessus	SuSE Local Security Checks	2026/8/19	2026/9/3	high
328474	Amazon Linux 2023 : python3, python3-devel, python3-idle (ALAS2023-2026-1963)	Nessus	Amazon Linux Local Security Checks	2026/7/20	2026/7/20	high
334781	SUSE SLES15: libpython3_11-1_0 / python311 / python311-base / python311-curses / etc (SUSE-SU-2026:3548-1)	Nessus	SuSE Local Security Checks	2026/8/12	2026/9/3	high
338682	openSUSE 16: libpython3_13-1_0 / libpython3_13-1_0-x86-64-v3 / libpython3_13t1_0 / etc (openSUSE-SU-2026:21595-1)	Nessus	SuSE Local Security Checks	2026/8/21	2026/9/3	high

检测

插件搜索

high

high

high

high

high