The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:4654 advisory.

  - python: infinite loop in the tarfile module via crafted TAR archive (CVE-2019-20907)

  - python-pip: directory traversal in _download_http_url() function in src/pip/_internal/download.py     (CVE-2019-20916)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2020:4432 advisory.

  - The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install     command, because a Content-Disposition header can have ../ in a filename, as demonstrated by overwriting     the /root/.ssh/authorized_keys file. This occurs in _download_http_url in _internal/download.py.
    (CVE-2019-20916)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for python3 fixes the following issues :

Update to 3.6.12 (bsc#1179193), including :

  - Fixed a directory traversal in _download_http_url()     (bsc#1176262 CVE-2019-20916)

This update was imported from the SUSE:SLE-15:Update update project.

This update for python fixes the following issues :

  - Fixed a directory traversal in _download_http_url()     (bsc#1176262 CVE-2019-20916)

This update was imported from the SUSE:SLE-15:Update update project.

This update for python-setuptools fixes the following issues :

  - Fixed a directory traversal in _download_http_url()     (bsc#1176262 CVE-2019-20916)

This update was imported from the SUSE:SLE-15-SP1:Update update project.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2022:5234 advisory.

    The virtualenv tool creates isolated Python environments. The virtualenv tool is a successor to     workingenv, and an extension of virtual-python.

    Security Fix(es):

    * python-pip: directory traversal in _download_http_url() function in src/pip/_internal/download.py     (CVE-2019-20916)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-4601-1 advisory.

    It was discovered that pip did not properly sanitize the filename during pip install. A remote attacker     could possible use this issue to read and

    write arbitrary files on the host filesystem as root, resulting in a

    directory traversal attack. (CVE-2019-20916)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for python fixes the following issues :

buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution (bsc#1181126, CVE-2021-3177).

Provide the newest setuptools wheel (bsc#1176262, CVE-2019-20916) in their correct form (bsc#1180686).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for python3 fixes the following issues :

CVE-2021-3177: Fixed buffer overflow in PyCArg_repr in
_ctypes/callproc.c, which may lead to remote code execution (bsc#1181126).

Provide the newest setuptools wheel (bsc#1176262, CVE-2019-20916) in their correct form (bsc#1180686).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2020-772:01 advisory.

    * python: XSS vulnerability in the documentation XML-RPC server in server_title field (CVE-2019-16935)
      * python: CRLF injection via the host part of the url passed to urlopen() (CVE-2019-18348)
      * python: infinite loop in the tarfile module via crafted TAR archive (CVE-2019-20907)
      * python-pip: directory traversal in _download_http_url() function in src/pip/_internal/download.py     (CVE-2019-20916)
      * python: wrong backtracking in urllib.request.AbstractBasicAuthHandler allows for a ReDoS     (CVE-2020-8492)
      * python: DoS via inefficiency in IPv{4,6}Interface classes (CVE-2020-14422)
      * python: CRLF injection via HTTP request method in httplib/http.client (CVE-2020-26116)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
146020	CentOS 8 : python27:2.7 (CESA-2020:4654)	Nessus	CentOS Local Security Checks	2021/2/1	2024/1/24	high
157499	AlmaLinux 8 : python-pip (ALSA-2020:4432)	Nessus	Alma Linux Local Security Checks	2022/2/9	2023/11/13	high
143492	openSUSE Security Update : python3 (openSUSE-2020-2152)	Nessus	SuSE Local Security Checks	2020/12/7	2024/2/7	high
144033	openSUSE Security Update : python (openSUSE-2020-2211)	Nessus	SuSE Local Security Checks	2020/12/10	2024/2/2	high
143460	openSUSE Security Update : python-setuptools (openSUSE-2020-2143)	Nessus	SuSE Local Security Checks	2020/12/3	2024/2/7	high
143536	openSUSE Security Update : python3 (openSUSE-2020-2190)	Nessus	SuSE Local Security Checks	2020/12/8	2024/2/6	high
162584	RHEL 7 : python-virtualenv (RHSA-2022:5234)	Nessus	Red Hat Local Security Checks	2022/6/28	2024/11/8	high
141820	Ubuntu 18.04 LTS : pip vulnerability (USN-4601-1)	Nessus	Ubuntu Local Security Checks	2020/10/22	2024/8/29	high
146367	SUSE SLED15 / SLES15 Security Update : python (SUSE-SU-2021:0355-1)	Nessus	SuSE Local Security Checks	2021/2/10	2024/1/22	critical
146729	SUSE SLED15 / SLES15 Security Update : python3 (SUSE-SU-2021:0529-1)	Nessus	SuSE Local Security Checks	2021/2/22	2024/1/19	critical
291633	MiracleLinux 7 : rh-python36-python-pip-9.0.1-5.el7, rh-python36-python-3.6.12-1.el7, rh-python36-python-virtualenv-15.1.0-3.el7 (AXSA:2020-772:01)	Nessus	Miracle Linux Local Security Checks	2026/1/19	2026/1/19	high

检测

插件搜索

high

high

high

high

high

high

high

high

critical

critical

high