The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4273 advisory.

    Python is an interpreted, interactive, object-oriented programming language, which includes modules,     classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to     many system calls and libraries, as well as to various windowing systems.

    The following packages have been upgraded to a later upstream version: python27-python (2.7.18).
    (BZ#1882656)

    Security Fix(es):

    * python: CRLF injection via the host part of the url passed to urlopen() (CVE-2019-18348)

    * python: infinite loop in the tarfile module via crafted TAR archive (CVE-2019-20907)

    * python-pip: directory traversal in _download_http_url() function in src/pip/_internal/download.py     (CVE-2019-20916)

    * python: CRLF injection via HTTP request method in httplib/http.client (CVE-2020-26116)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * python27-python-pip: Bundles own CA bundle instead of using system CA bundle (BZ#1882668)

    * python27-python-pip: Contains multiple bundled libraries, and has no bundled() provides (BZ#1882669)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Python 3.5 has now entered 'security fixes only' mode, and as such the only changes since Python 3.5.4 are security fixes.

https://www.python.org/downloads/release/python-358/

https://docs.python.org/3.5/whatsnew/changelog.html#python-3-5-8

Security fix for CVE-2019-9740, CVE-2019-10160, CVE-2019-16935, CVE-2019-18348 , CVE-2019-16056.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the python2 package has been released.

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4333-1 advisory.

    It was discovered that Python incorrectly stripped certain characters from requests. A remote attacker     could use this issue to perform CRLF injection. (CVE-2019-18348)

    It was discovered that Python incorrectly handled certain HTTP requests. An attacker could possibly use     this issue to cause a denial of service. (CVE-2020-8492)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for python fixes the following issues :

Security issues fixed :

CVE-2019-18348: Fixed a CRLF injection via the host part of the url passed to urlopen(). Now an InvalidURL exception is raised (bsc#1155094).

CVE-2019-9674: Improved the documentation to reflect the dangers of zip-bombs (bsc#1162825).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for python fixes the following issues :

Security issues fixed :

  - CVE-2019-18348: Fixed a CRLF injection via the host part     of the url passed to urlopen(). Now an InvalidURL     exception is raised (bsc#1155094).

  - CVE-2019-9674: Improved the documentation to reflect the     dangers of zip-bombs (bsc#1162825).

This update was imported from the SUSE:SLE-15:Update update project.

An update of the python3 package has been released.

Python reports :

The AbstractBasicAuthHandler class of the urllib.request module uses an inefficient regular expression which can be exploited by an attacker to cause a denial of service. Fix the regex to prevent the catastrophic backtracking. Vulnerability reported by Ben Caller and Matt Schwager.

Disallow control characters in hostnames in http.client, addressing CVE-2019-18348. Such potentially malicious header injection URLs now cause a InvalidURL to be raised.

Disallow CR or LF in email.headerregistry.Address arguments to guard against header injection attacks.

The version of F5 Networks BIG-IP installed on the remote host is prior to 17.5.1.1. It is, therefore, affected by a vulnerability as referenced in the K000153042 advisory.

    An issue was discovered in urllib2 in Python 2.x through 2.7.17 and urllib in Python 3.x through 3.8.0.
    CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument     to urllib.request.urlopen with \r\n (specifically in the host component of a URL) followed by an HTTP     header. This is similar to the CVE-2019-9740 query string issue and the CVE-2019-9947 path string issue.
    (This is not exploitable when glibc has CVE-2016-10739 fixed.). This is fixed in: v2.7.18, v2.7.18rc1;
    v3.5.10, v3.5.10rc1; v3.6.11, v3.6.11rc1, v3.6.12; v3.7.8, v3.7.8rc1, v3.7.9; v3.8.3, v3.8.3rc1, v3.8.4,     v3.8.4rc1, v3.8.5, v3.8.6, v3.8.6rc1.(CVE-2019-18348)

Tenable has extracted the preceding description block directly from the F5 Networks BIG-IP security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of python26 installed on the remote host is prior to 2.6.9-2.92. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2025-1972 advisory.

    A CRLF injection flaw was discovered in python in the way URLs are handled when doing an HTTP/HTTPS     connection (e.g. through urlopen() or HTTPConnection). An attacker who can control the url parameter     passed to urlopen method in the urllib/urllib2 modules can inject CRLF sequences and HTTP headers by     abusing the host part of the URL. (CVE-2019-18348)

    A flaw was found in python. In Lib/tarfile.py an attacker is able to craft a TAR archive leading to an     infinite loop when opened by tarfile.open, because _proc_pax lacks header validation. (CVE-2019-20907)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
170304	RHEL 7 : python27 (RHSA-2020:4273)	Nessus	Red Hat Local Security Checks	2023/1/23	2024/11/7	high
130793	Fedora 30 : python35 (2019-b06ec6159b)	Nessus	Fedora Local Security Checks	2019/11/12	2024/4/12	critical
135404	Photon OS 3.0: Python2 PHSA-2020-3.0-0073	Nessus	PhotonOS Local Security Checks	2020/4/12	2025/8/22	medium
135487	Photon OS 1.0: Python2 PHSA-2020-1.0-0287	Nessus	PhotonOS Local Security Checks	2020/4/15	2020/4/21	medium
135894	Ubuntu 16.04 LTS / 18.04 LTS : Python vulnerabilities (USN-4333-1)	Nessus	Ubuntu Local Security Checks	2020/4/22	2024/8/29	medium
136798	SUSE SLED15 / SLES15 Security Update : python (SUSE-SU-2020:1339-1)	Nessus	SuSE Local Security Checks	2020/5/22	2021/1/13	medium
136884	openSUSE Security Update : python (openSUSE-2020-696)	Nessus	SuSE Local Security Checks	2020/5/26	2020/5/28	medium
137877	Photon OS 1.0: Python3 PHSA-2020-1.0-0304	Nessus	PhotonOS Local Security Checks	2020/6/29	2024/3/5	medium
138125	FreeBSD : Python -- multiple vulnerabilities (33c05d57-bf6e-11ea-ba1e-0800273f78d3)	Nessus	FreeBSD Local Security Checks	2020/7/6	2024/3/4	medium
253661	F5 Networks BIG-IP : Python urllib vulnerability (K000153042)	Nessus	F5 Networks Local Security Checks	2025/8/22	2026/3/13	medium
234998	Amazon Linux AMI : python26 (ALAS-2025-1972)	Nessus	Amazon Linux Local Security Checks	2025/4/30	2025/4/30	medium

检测

插件搜索

high

critical

medium

medium

medium

medium

medium

medium

medium

medium

medium