The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-ae330775b9 advisory.

    JIT translation fix for bootstraping, require openssl 3 and fix CVE-2026-25645 and CVE-2025-8869


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:1647-1 advisory.

    - CVE-2026-25645: `extract_zipped_paths()` uses predictable filenames when extracting files from zip     archives and       reuses target files that already exist without validation (bsc#1260589).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the python-pip packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    Requests is a HTTP library. Prior to version 2.33.0, the `requests.utils.extract_zipped_paths()` utility     function uses a predictable filename when extracting files from zip archives into the system temporary     directory. If the target file already exists, it is reused without validation. A local attacker with write     access to the temp directory could pre-create a malicious file that would be loaded in place of the     legitimate one. Standard usage of the Requests library is not affected by this vulnerability. Only     applications that call `extract_zipped_paths()` directly are impacted. Starting in version 2.33.0, the     library extracts files to a non-deterministic location. If developers are unable to upgrade, they can set     `TMPDIR` in their environment to a directory with restricted write access.(CVE-2026-25645)

    When pip is installing and extracting a maliciously crafted wheel archive, files may be extracted outside     the installation directory. The path traversal is limited to prefixes of the installation directory, thus     isn't able to inject or overwrite executable files in typical situations.(CVE-2026-1703)

Tenable has extracted the preceding description block directly from the EulerOS python-pip security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the python-requests packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    Requests is a HTTP library. Prior to version 2.33.0, the `requests.utils.extract_zipped_paths()` utility     function uses a predictable filename when extracting files from zip archives into the system temporary     directory. If the target file already exists, it is reused without validation. A local attacker with write     access to the temp directory could pre-create a malicious file that would be loaded in place of the     legitimate one. Standard usage of the Requests library is not affected by this vulnerability. Only     applications that call `extract_zipped_paths()` directly are impacted. Starting in version 2.33.0, the     library extracts files to a non-deterministic location. If developers are unable to upgrade, they can set     `TMPDIR` in their environment to a directory with restricted write access.(CVE-2026-25645)

Tenable has extracted the preceding description block directly from the EulerOS python-requests security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the python-requests packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

    An unclaimed Amazon S3 bucket, 'codeconf', is referenced in an audio file link within the .rst     documentation file. This bucket has been claimed by an external party. The use of this unclaimed S3 bucket     could lead to data integrity issues, data leakage, availability problems, loss of trustworthiness, and     potential further attacks if the bucket is used to host malicious content or as a pivot point for further     attacks.(CVE-2024-1682)

    Requests is a HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc     credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4     to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with     `trust_env=False` on one's Requests Session.(CVE-2024-47081)

    Requests is a HTTP library. Prior to version 2.33.0, the `requests.utils.extract_zipped_paths()` utility     function uses a predictable filename when extracting files from zip archives into the system temporary     directory. If the target file already exists, it is reused without validation. A local attacker with write     access to the temp directory could pre-create a malicious file that would be loaded in place of the     legitimate one. Standard usage of the Requests library is not affected by this vulnerability. Only     applications that call `extract_zipped_paths()` directly are impacted. Starting in version 2.33.0, the     library extracts files to a non-deterministic location. If developers are unable to upgrade, they can set     `TMPDIR` in their environment to a directory with restricted write access.(CVE-2026-25645)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization python-requests security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-44919b3d9f advisory.

    2.33.1 (2026-03-30)
    -------------------

    **Bugfixes**
    - Fixed test cleanup for CVE-2026-25645 to avoid leaving unnecessary       files in the tmp directory.
    - Fixed Content-Type header parsing for malformed values.
    - Improved error consistency for malformed header values.

    2.33.0 (2026-03-25)
    -------------------

    **Announcements**
    -  Requests is adding inline types. If you have a typed code base that     uses Requests, please take a look at     [#7271](https://github.com/psf/requests/issues/7271).
    Give it a try, and report any gaps or feedback you may have in the issue. 

    **Security**
    - [CVE-2026-25645](https://www.cve.org/CVERecord?id=CVE-2026-25645)       `requests.utils.extract_zipped_paths` now extracts       contents to a non-deterministic location to prevent malicious file       replacement. This does not affect default usage of Requests, only       applications calling the utility function directly.

    **Improvements**
    - Migrated to a PEP 517 build system using setuptools.

    **Bugfixes**
    - Fixed an issue where an empty netrc entry could cause       malformed authentication to be applied to Requests on       Python 3.11+.

    **Deprecations**
    - Dropped support for Python 3.9 following its end of support.

    **Documentation**
    - Various typo fixes and doc improvements.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the  package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

    Requests is a HTTP library. Prior to version 2.33.0, the `requests.utils.extract_zipped_paths()` utility     function uses a predictable filename when extracting files from zip archives into the system temporary     directory. If the target file already exists, it is reused without validation. A local attacker with write     access to the temp directory could pre-create a malicious file that would be loaded in place of the     legitimate one. Standard usage of the Requests library is not affected by this vulnerability. Only     applications that call `extract_zipped_paths()` directly are impacted. Starting in version 2.33.0, the     library extracts files to a non-deterministic location. If developers are unable to upgrade, they can set     `TMPDIR` in their environment to a directory with restricted write access.(CVE-2026-25645)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the python-requests packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

    Requests is a HTTP library. Prior to version 2.33.0, the `requests.utils.extract_zipped_paths()` utility     function uses a predictable filename when extracting files from zip archives into the system temporary     directory. If the target file already exists, it is reused without validation. A local attacker with write     access to the temp directory could pre-create a malicious file that would be loaded in place of the     legitimate one. Standard usage of the Requests library is not affected by this vulnerability. Only     applications that call `extract_zipped_paths()` directly are impacted. Starting in version 2.33.0, the     library extracts files to a non-deterministic location. If developers are unable to upgrade, they can set     `TMPDIR` in their environment to a directory with restricted write access.(CVE-2026-25645)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization python-requests security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the python-pip packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

    Requests is a HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc     credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4     to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with     `trust_env=False` on one's Requests Session.(CVE-2024-47081)

    Requests is a HTTP library. Since Requests 2.3.0, Requests has been leaking Proxy-Authorization headers to     destination servers when redirected to an HTTPS endpoint. This is a product of how we use     `rebuild_proxies` to reattach the `Proxy-Authorization` header to requests. For HTTP connections sent     through the tunnel, the proxy will identify the header in the request itself and remove it prior to     forwarding to the destination server. However when sent over HTTPS, the `Proxy-Authorization` header must     be sent in the CONNECT request as the proxy has no visibility into the tunneled request. This results in     Requests forwarding proxy credentials to the destination server unintentionally, allowing a malicious     actor to potentially exfiltrate sensitive information. This issue has been patched in version     2.31.0.(CVE-2023-32681)

    urllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, it is possible to disable     redirects for all requests by instantiating a PoolManager and specifying retries in a way that disable     redirects. By default, requests and botocore users are not affected. An application attempting to mitigate     SSRF or open redirect vulnerabilities by disabling redirects at the PoolManager level will remain     vulnerable. This issue has been patched in version 2.5.0.(CVE-2025-50181)

    When extracting a tar archive pip may not check symbolic links point into the extraction directory if the     tarfile module doesn't implement PEP 706.Note that upgrading pip to a 'fixed' version for this     vulnerability doesn't fix all known vulnerabilities that are remediated by using a Python version that     implements PEP 706.Note that this is a vulnerability in pip's fallback implementation of tar extraction     for Python versions that don't implement PEP 706 and therefore are not secure to all vulnerabilities in     the Python 'tarfile' module. If you're using a Python version that implements PEP 706 then pip doesn't use     the 'vulnerable' fallback code.Mitigations include upgrading to a version of pip that includes the fix,     upgrading to a Python version that implements PEP 706 (Python =3.9.17, =3.10.12, =3.11.4, or     =3.12),applying the linked patch, or inspecting source distributions (sdists) before installation as is     already a best-practice.(CVE-2025-8869)

    urllib3 is an HTTP client library for Python. urllib3's streaming API is designed for the efficient     handling of large HTTP responses by reading the content in chunks, rather than loading the entire response     body into memory at once. urllib3 can perform decoding or decompression based on the HTTP `Content-     Encoding` header (e.g., `gzip`, `deflate`, `br`, or `zstd`). When using the streaming API, the library     decompresses only the necessary bytes, enabling partial content consumption. Starting in version 1.22 and     prior to version 2.6.3, for HTTP redirect responses, the library would read the entire response body to     drain the connection and decompress the content unnecessarily. This decompression occurred even before any     read methods were called, and configured read limits did not restrict the amount of decompressed data. As     a result, there was no safeguard against decompression bombs. A malicious server could exploit this to     trigger excessive resource consumption on the client. Applications and libraries are affected when they     stream content from untrusted sources by setting `preload_content=False` when they do not disable     redirects. Users should upgrade to at least urllib3 v2.6.3, in which the library does not decode content     of redirect responses when `preload_content=False`. If upgrading is not immediately possible, disable     redirects by setting `redirect=False` for requests to untrusted source.(CVE-2026-21441)

    urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.24 and prior to 2.6.0,     the number of links in the decompression chain was unbounded allowing a malicious server to insert a     virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation     for the decompressed data. This vulnerability is fixed in 2.6.0.(CVE-2025-66418)

    pip would treat console_scripts and gui_scripts as paths instead of file names without sanitizing the     resolved absolute path to the installation directory, leading to entry points being installed outside the     installation directory.(CVE-2026-8643)

    pip handles concatenated tar and ZIP files as ZIP files regardless of filename or whether a file is both a     tar and ZIP file. This behavior could result in confusing installation behavior, such as installing     'incorrect' files according to the filename of the archive. New behavior only proceeds with installation     if the file identifies uniquely as a ZIP or tar archive, not as both.(CVE-2026-3219)

    Requests is a HTTP library. Prior to version 2.33.0, the `requests.utils.extract_zipped_paths()` utility     function uses a predictable filename when extracting files from zip archives into the system temporary     directory. If the target file already exists, it is reused without validation. A local attacker with write     access to the temp directory could pre-create a malicious file that would be loaded in place of the     legitimate one. Standard usage of the Requests library is not affected by this vulnerability. Only     applications that call `extract_zipped_paths()` directly are impacted. Starting in version 2.33.0, the     library extracts files to a non-deterministic location. If developers are unable to upgrade, they can set     `TMPDIR` in their environment to a directory with restricted write access.(CVE-2026-25645)

    When pip is installing and extracting a maliciously crafted wheel archive, files may be extracted outside     the installation directory. The path traversal is limited to prefixes of the installation directory, thus     isn't able to inject or overwrite executable files in typical situations.(CVE-2026-1703)

    urllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin redirects followed     from the low-level API via ProxyManager.connection_from_url().urlopen(..., assert_same_host=False) still     forward these sensitive headers. This vulnerability is fixed in 2.7.0.(CVE-2026-44431)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization python-pip security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-8825-1 advisory.

    It was discovered that Requests did not correctly handle generating random temporary file paths. An     attacker could possibly use this issue to execute arbitrary code.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
306477	Fedora 45 : pypy (2026-ae330775b9)	Nessus	Fedora Local Security Checks	2026/4/15	2026/4/15	medium
311758	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : python-requests (SUSE-SU-2026:1647-1)	Nessus	SuSE Local Security Checks	2026/5/2	2026/5/2	medium
320290	EulerOS 2.0 SP13 : python-pip (EulerOS-SA-2026-2353)	Nessus	Huawei Local Security Checks	2026/6/10	2026/6/10	low
320309	EulerOS 2.0 SP13 : python-requests (EulerOS-SA-2026-2313)	Nessus	Huawei Local Security Checks	2026/6/10	2026/6/10	medium
326171	EulerOS 2.0 SP12 : python-requests (EulerOS-SA-2026-2623)	Nessus	Huawei Local Security Checks	2026/7/10	2026/7/10	medium
347196	EulerOS Virtualization 2.11.0 : python-requests (EulerOS-SA-2026-3554)	Nessus	Huawei Local Security Checks	2026/9/18	2026/9/18	medium
313663	Fedora 44 : python-pulp-glue / python-requests (2026-44919b3d9f)	Nessus	Fedora Local Security Checks	2026/5/10	2026/5/10	medium
326208	EulerOS 2.0 SP12 : python-pip (EulerOS-SA-2026-2620)	Nessus	Huawei Local Security Checks	2026/7/10	2026/7/10	low
328566	EulerOS Virtualization 2.12.1 (EulerOS-SA-2026-2754)	Nessus	Huawei Local Security Checks	2026/7/21	2026/7/21	medium
319949	EulerOS 2.0 SP11 : python-requests (EulerOS-SA-2026-2263)	Nessus	Huawei Local Security Checks	2026/6/9	2026/6/9	medium
319966	EulerOS 2.0 SP11 : python-requests (EulerOS-SA-2026-2226)	Nessus	Huawei Local Security Checks	2026/6/9	2026/6/9	medium
320721	EulerOS Virtualization 2.13.1 : python-requests (EulerOS-SA-2026-2388)	Nessus	Huawei Local Security Checks	2026/6/12	2026/6/12	medium
347295	EulerOS Virtualization 2.11.1 : python-pip (EulerOS-SA-2026-3464)	Nessus	Huawei Local Security Checks	2026/9/18	2026/9/18	high
350931	Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : Requests vulnerability (USN-8825-1)	Nessus	Ubuntu Local Security Checks	2026/9/29	2026/9/29	medium

检测

插件搜索

medium

medium

low

medium

medium

medium

medium

low

medium

medium

medium

medium

high

medium