This update for python-setuptools fixes the following issues :

  - Fixed a directory traversal in _download_http_url()     (bsc#1176262 CVE-2019-20916)

This update was imported from the SUSE:SLE-15-SP1:Update update project.

This update for python fixes the following issues :

Fixed a directory traversal in _download_http_url() (bsc#1176262 CVE-2019-20916)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for python3 fixes the following issues :

  - CVE-2021-3177: Fixed buffer overflow in PyCArg_repr in
    _ctypes/callproc.c, which may lead to remote code     execution (bsc#1181126).

  - Provide the newest setuptools wheel (bsc#1176262,     CVE-2019-20916) in their correct form (bsc#1180686).

According to the version of the python-pip package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability :

  - The pip package before 19.2 for Python allows Directory     Traversal when a URL is given in an install command,     because a Content-Disposition header can have ../ in a     filename, as demonstrated by overwriting the     /root/.ssh/authorized_keys file. This occurs in
    _download_http_url in
    _internal/download.py.(CVE-2019-20916)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1639 advisory.

    The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install     command, because a Content-Disposition header can have ../ in a filename, as demonstrated by overwriting     the /root/.ssh/authorized_keys file. This occurs in _download_http_url in _internal/download.py.
    (CVE-2019-20916)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2022-5234 advisory.

    [15.1.0-7]
    - Security fix for CVE-2019-20916 for the bundled pip wheel     Resolves: rhbz#1868135

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2020-1044:05 advisory.

    * python-pip: directory traversal in _download_http_url() function in src/pip/_internal/download.py     (CVE-2019-20916)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 7 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2022-3284:03 advisory.

    * python-pip: directory traversal in _download_http_url() function in src/pip/_internal/download.py     (CVE-2019-20916)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
143550	openSUSE Security Update : python-setuptools (openSUSE-2020-2185)	Nessus	SuSE Local Security Checks	2020/12/8	2024/2/6	high
143611	SUSE SLED15 / SLES15 Security Update : python (SUSE-SU-2020:3597-1)	Nessus	SuSE Local Security Checks	2020/12/9	2024/2/6	high
144121	SUSE SLES12 Security Update : python (SUSE-SU-2020:3765-1)	Nessus	SuSE Local Security Checks	2020/12/14	2024/2/2	high
146851	openSUSE Security Update : python3 (openSUSE-2021-331)	Nessus	SuSE Local Security Checks	2021/2/25	2024/1/19	critical
147070	EulerOS Virtualization for ARM 64 3.0.6.0 : python-pip (EulerOS-SA-2021-1572)	Nessus	Huawei Local Security Checks	2021/3/4	2024/1/16	high
149875	Amazon Linux 2 : python-pip (ALAS-2021-1639)	Nessus	Amazon Linux Local Security Checks	2021/5/24	2024/12/11	high
162589	Oracle Linux 7 : python-virtualenv (ELSA-2022-5234)	Nessus	Oracle Linux Local Security Checks	2022/6/29	2024/11/1	high
294277	MiracleLinux 8 : python-pip-9.0.3-18.el8 (AXSA:2020-1044:05)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	high
294372	MiracleLinux 7 : python-virtualenv-15.1.0-7.el7 (AXSA:2022-3284:03)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	high

检测

插件搜索

high

high

high

critical

high

high

high

high

high