The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3560-1 advisory.

    Security issues fixed:

    - CVE-2026-0864: improper handling of line-ending characters can lead to configuration file injection when     the       `configparser` module is used (bsc#1269066).
    - CVE-2026-3276: quadratic complexity in `unicodedata.normalize()` can lead to DoS when processing     specially crafted       Unicode input (bsc#1267581).
    - CVE-2026-4360: in the Tarfile.extract() function, the filter parameter is not passed properly when     extracting       hardlinks (bsc#1269959).
    - CVE-2026-7210: `xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-     flooding       protection (bsc#1264962).
    - CVE-2026-7774: `tarfile.data_filter` path traversal bypass allows writing outside the extraction     directory       (bsc#1267821).
    - CVE-2026-8328: `ftpcp()` does not use actual peer address and trusts server-supplied PASV host address     (bsc#1265268).
    - CVE-2026-11940: tarfile extraction filter bypass via a crafted archive allows escaping the destination     directory and       enables arbitrary file reads and writes (bsc#1268977).
    - CVE-2026-11972: infinite loop due to improper EOF handling in the tarfile module streaming mode can lead     to DoS       (bsc#1269788).
    - CVE-2026-15308: Incremental HTMLParser allows CPU-exhaustion DoS via repeated unterminated markup     declarations       (bsc#1271192).

    Non security issue fixed:

    - [kernel 7.1] udplite was removed -> python fails in tests (bsc#1268375).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3569-1 advisory.

    Security issues fixed:

    - CVE-2026-0864: improper handling of line-ending characters can lead to configuration file injection when     the       `configparser` module is used (bsc#1269066).
    - CVE-2026-3276: quadratic complexity in `unicodedata.normalize()` can lead to DoS when processing     specially crafted       Unicode input (bsc#1267581).
    - CVE-2026-4360: in the Tarfile.extract() function, the filter parameter is not passed properly when     extracting       hardlinks (bsc#1269959).
    - CVE-2026-7210: `xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-     flooding       protection (bsc#1264962).
    - CVE-2026-7774: `tarfile.data_filter` path traversal bypass allows writing outside the extraction     directory       (bsc#1267821).
    - CVE-2026-8328: `ftpcp()` does not use actual peer address and trusts server-supplied PASV host address     (bsc#1265268).
    - CVE-2026-11940: tarfile extraction filter bypass via a crafted archive allows escaping the destination     directory and       enables arbitrary file reads and writes (bsc#1268977).
    - CVE-2026-11972: infinite loop due to improper EOF handling in the tarfile module streaming mode can lead     to DoS       (bsc#1269788).
    - CVE-2026-15308: Incremental HTMLParser allows CPU-exhaustion DoS via repeated unterminated markup     declarations       (bsc#1271192).

    Non security issues fixed:

    - [kernel 7.1] udplite was removed -> python fails in tests (bsc#1268375).
    - crypto-policies: Extend the crypto-policies support for mozilla-nss, openjdk, krb5, bind, stunnel,     openssh, libssh and       more packages (bsc#1211301).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4534-1 advisory.

    - CVE-2025-13462: incorrect parsing of TarInfo header when GNU long name and type AREGTYPE are combined     (bsc#1259611).
    - CVE-2026-0864: improper handling of line-ending characters can lead to configuration file injection when     the       `configparser` module is used (bsc#1269066).
    - CVE-2026-1502: HTTP client proxy tunnel headers not validated for CR/LF (bsc#1261969).
    - CVE-2026-2297: cpython: incorrectly handled hook in FileLoader can lead to validation bypass     (bsc#1259240).
    - CVE-2026-3276: quadratic complexity in `unicodedata.normalize()` can lead to DoS when processing     specially crafted       Unicode input (bsc#1267581).
    - CVE-2026-4224: C stack overflow when parsing XML with deeply nested DTD content models (bsc#1259735).
    - CVE-2026-4360: in the Tarfile.extract() function, the filter parameter is not passed properly when     extracting       hardlinks (bsc#1269959).
    - CVE-2026-4519: leading dashes in URLs are accepted by the `webbrowser.open()` API and allow for web     browser command       line option injection (bsc#1260026).
    - CVE-2026-6100: Arbitrary code execution or information disclosure via use-after-free in decompression     modules       (bsc#1262098).
    - CVE-2026-7210: `xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-     flooding       protection (bsc#1264962).
    - CVE-2026-7774: `tarfile.data_filter` path traversal bypass allows writing outside the extraction     directory       (bsc#1267821).
    - CVE-2026-8328: `ftpcp()` does not use actual peer address and trusts server-supplied PASV host address     (bsc#1265268).
    - CVE-2026-9669: crafted input can cause a stack buffer overflow (bsc#1267974).
    - CVE-2026-11940: tarfile extraction filter bypass via a crafted archive allows escaping the destination     directory and       enables arbitrary file reads and writes (bsc#1268977).
    - CVE-2026-11972: infinite loop due to improper EOF handling in the tarfile module streaming mode can lead     to DoS       (bsc#1269788).
    - CVE-2026-15308: Incremental HTMLParser allows CPU-exhaustion DoS via repeated unterminated markup     declarations       (bsc#1271192).
    - CVE-2026-15310: memory exhaustion in zipfile in bzip2/LZMA/Zstandard decompression (bsc#1277111).
    - CVE-2026-15806: urllib.request.HTTPPasswordMgr credentials for one URL scheme sent over another scheme     (bsc#1276223).
    - CVE-2026-17084: StringPrep algorithm considered Unicode codepoint attributes outside Unicode 3.2.0     (bsc#1276226).
    - CVE-2026-19672: The tarfile module's tar and data extraction filters created directories outside the     destination for       members whose name leaves the destination and retu (bsc#1276227).

    Changes for python312:

    - Update to 3.12.14:
     - Core and Builtins
     - gh-139808: Add branch protections for AArch64 (BTI/PAC) in      assembly code used by -X perf_jit (Linux perf profiler      integration).
     - Documentation
     - gh-136155: We are now checking for fatal errors in EPUB      builds in CI.
     - Library
     - gh-109638: Fix exponential time in csv.Sniffer.sniff() for      a sample which contains many quote characters. A doubled      quote character is now also detected in a field which      contains the delimiter or a line break.
     - gh-98820: Fix quadratic time in csv.Sniffer.sniff() for      a sample which contains quoted fields, in particular for      a single column of quoted fields.
     - gh-149231: In tomllib, the number of parts in TOML keys is      now limited.
     - gh-146083: Update bundled libexpat to version 2.7.5.
     - gh-141707: Don't change tarfile.TarInfo type from AREGTYPE      to DIRTYPE when parsing GNU long name or link headers      (bsc#1259611, CVE-2025-13462).
     - gh-90949: Add      SetBillionLaughsAttackProtectionActivationThreshold() and      SetBillionLaughsAttackProtectionMaximumAmplification() to      xmlparser objects to tune protections against billion      laughs attacks. Patch by B?n?dikt Tran.
     - Security
     - gh-155558: Update bundled libexpat to version 2.8.3 for the      fix to CVE 2026-72522.
     - gh-153030: Fixed quadratic complexity in incremental      parsing of long unterminated constructs (such as tags or      comments) in html.parser.HTMLParser, which could be      exploited for a denial of service (bsc#1271192,      CVE-2026-15308).
     - gh-152674: The xml.etree.ElementTree.Element methods      findall(), iterfind() and find() avoid quadratic behavior      when using XPath index predicates ([1], [last()],      [last()-N]) on XML documents with many same-tag siblings.
     - gh-152216: Update bundled libexpat to version 2.8.2.
     - gh-151987: The tarfile.TarFile.extract() method now applies      the given filter when it extracts a link target from the      archive as a fallback (bsc#1269959, CVE-2026-4360).
     - gh-151981: In tarfile, seeking a stream now stops when end      of the stream is reached (bsc#1269788, CVE-2026-11972).
     - gh-151544: Modules/Setup.local is no longer used as      a landmark to discover whether Python is running in      a source tree, as it could potentially affect actual      installs. The pybuilddir.txt file is now the sole indicator      of running in a source tree.
     - gh-151558: Fixed an vulnerability in the tarfile data and      tar extraction filters where crafted archives could create      a symlink pointing outside the destination directory. This      was a bypass of CVE 2025-4330 (bsc#1268977,      CVE-2026-11940).
     - gh-150599: Fix a possible stack buffer overflow in bz2 when      a bz2.BZ2Decompressor is reused after a decompression      error. The decompressor now becomes unusable after libbz2      reports an error (bsc#1267974, CVE-2026-9669).
     - gh-150743: http.client now limits the number of      chunked-response trailer lines it will read to 100, and the      number of interim (1xx) responses it will skip to 100.
     A malicious or broken server could previously stream      trailer lines or 100 Continue responses forever, hanging      the client even when a socket timeout was in use. Reported      by @YLChen-007 via GHSA-w4q2-g22w-6fr4.
     - gh-149698: Update bundled libexpat to version 2.8.1 for the      fix for CVE 2026-45186.
     - gh-87451: The ftplib module's undocumented ftpcp function      no longer trusts the IPv4 address value returned from the      source server in response to the PASV command by default,      completing the fix for CVE-2021-4189. As with ftplib.FTP,      the former behavior can be re-enabled by setting the      trust_server_pasv_ipv4_address attribute on the source      ftplib.FTP instance to True. Thanks to Qi Deng at Aurascape      AI for the report (bsc#1265268, CVE-2026-8328).
     - gh-149486: tarfile.data_filter() now validates link targets      using the same normalised value that is written to disk,      strips trailing separators from the member name when      resolving a symlink's directory, and rejects link members      that would replace the destination directory itself. This      closes several path-traversal bypasses of the data      extraction filter (bsc#1267821, CVE-2026-7774).
     - gh-149079: Fix a potential denial of service in      unicodedata.normalize(). The canonical ordering step of      Unicode normalization used a quadratic-time insertion sort      for reordering combining characters, which could be      exploited with crafted input containing many combining      characters in non-canonical order. Replaced with      a linear-time counting sort for long runs (bsc#1267581,      CVE-2026-3276).
     - gh-149018: Improved protection against XML hash-flooding      attacks in xml.parsers.expat and xml.etree.ElementTree when      Python is compiled with libExpat 2.8.0 or later      (bsc#1264962, CVE-2026-7210).
     - gh-149017: Update bundled libexpat to version 2.8.0.
     - gh-148808: Added buffer boundary check when using nbytes      parameter with      asyncio.AbstractEventLoop.sock_recvfrom_into(). Only      relevant for Windows and the asyncio.ProactorEventLoop.
     - gh-148395: Fix a dangling input pointer in      lzma.LZMADecompressor, bz2.BZ2Decompressor, and internal      zlib._ZlibDecompressor when memory allocation fails with      MemoryError, which could let a subsequent decompress() call      read or write through a stale pointer to the      already-released caller buffer (bsc#1262098, CVE-2026-6100,      seems like it has been incompletely applied      gh#python/cpython#151605).
     - gh-148169: A bypass in webbrowser allowed URLs prefixed      with %action to pass the dash-prefix safety check      (bsc#1262098, CVE-2026-6100).
     - gh-146581: Fix vulnerability in shutil.unpack_archive() for      ZIP files on Windows which allowed to write files outside      of the destination tree if the patch in the archive      contains a Windows drive prefix. Now such invalid paths      will be skipped. Files containing '..' in the name (like      'foo..bar') are no longer skipped.
     - gh-146333: Fix quadratic backtracking in      configparser.RawConfigParser option parsing regexes (OPTCRE      and OPTCRE_NV). A crafted configuration line with many      whitespace characters could cause excessive CPU usage.
     - gh-146211: Reject CR/LF characters in tunnel request      headers for the HTTPConnection.set_tunnel() method      (bsc#1261969, CVE-2026-1502).
     - gh-145986: xml.parsers.expat: Fixed a crash caused by      unbounded C recursion when converting deeply nested XML      content models with ElementDeclHandler(). This addresses      CVE 2026-4224 (bsc#1259735, CVE-2026-4224).
     - gh-145599: Reject control characters in http.cookies.Morsel      update() and js_output(). This addresses CVE 2026-3644.
     - gh-145506: Fixes CVE 2026-2297 by ensuring that      SourcelessFileLoader uses io.open_code() when opening .pyc      files (bsc#1259240, CVE-2026-2297).
     - gh-144370: Disallow usage of control characters in status      in wsgiref.handlers to prevent HTTP header injections.
     Patch by Benedikt Johannes.
     - gh-143930: Reject leading dashes in URLs passed to      webbrowser.open() (bsc#1260026, CVE-2026-4519).
     - gh-143927: Normalize all line endings (CR, CRLF, and LF) to      LF+TAB when writing multi-line configparser values      (bsc#1269066, CVE-2026-0864).
     - Tests
     - gh-149776: Fix test_socket on Linux kernel 7.1 and newer:
     skip UDP Lite tests if it's not supported. Patch by Victor      Stinner.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS / Pro Realtime 22.04 LTS / Pro Realtime 24.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8744-1 advisory.

    It was discovered that Python's http.cookies module incorrectly handled control characters in certain     cookie operations. An attacker could possibly use this issue to inject arbitrary content. This issue only     affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and     Ubuntu 24.04 LTS. (CVE-2026-3644)

    It was discovered that the Python pyexpat module was vulnerable to unbounded recursion in the Expat XML     parser. An attacker could possibly use this issue to cause Python to crash, resulting in a denial of     service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS,     Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-4224)

    It was discovered that Python's tarfile module did not correctly apply the filter parameter when     extracting hard links. An attacker could possibly use this issue to cause files to be extracted with an     unexpected uid or gid, bypassing the restrictions requested via filter='data'. (CVE-2026-4360)

    It was discovered that Python's http.cookies module incorrectly escaped values in the js_output() method.
    An attacker could possibly use this issue to inject arbitrary JavaScript. (CVE-2026-6019)

    It was discovered that Python's html.parser module incorrectly handled repeated unterminated markup     declarations. An attacker could possibly use this issue to cause Python to consume excessive CPU     resources, leading to a denial of service. (CVE-2026-15308)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
334701	SUSE SLED15: libpython3_11-1_0 / python311 / python311-base / python311-curses / etc (SUSE-SU-2026:3560-1)	Nessus	SuSE Local Security Checks	2026/8/12	2026/9/3	high
335071	SUSE SLES15: libpython3_12-1_0 / python312 / python312-base / python312-curses / etc (SUSE-SU-2026:3569-1)	Nessus	SuSE Local Security Checks	2026/8/13	2026/9/3	high
363776	SUSE SLES15: libpython3_12-1_0 / python312 / python312-base / python312-curses / etc (SUSE-SU-2026:4534-1)	Nessus	SuSE Local Security Checks	2026/10/7	2026/10/7	critical
344659	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS / Pro Realtime 22.04 LTS / Pro Realtime 24.04 LTS : Python vulnerabilities (USN-8744-1)	Nessus	Ubuntu Local Security Checks	2026/9/11	2026/9/11	high

检测

插件搜索

high

high

critical

high