The remote SUSE Linux SLES12 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2024:4165-1 advisory.

    - CVE-2024-11168: Fixed improper validation of IPv6 and IPvFuture addresses (bsc#1233307)

    Other fixes:
    - Add ipaddress module from https://github.com/phihag/ipaddress
    - Remove -IVendor/ from python-config (bsc#1231795)
    - Stop using %%defattr, it seems to be breaking proper executable       attributes on /usr/bin/ scripts (bsc#1227378).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:0047-1 advisory.

    This update for python39 fixes the following issue:

    - Update to 3.9.21

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of python3 installed on the remote host is prior to 3.7.16-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-2754 advisory.

    The urllib.parse.urlsplit() and urlparse() functions improperly validated bracketed hosts (`[]`), allowing     hosts that weren't IPv6 or IPvFuture. This behavior was not conformant to RFC 3986 and potentially enabled     SSRF if a URL is processed by more than one URL parser. (CVE-2024-11168)

    There is a MEDIUM severity vulnerability affecting CPython.

    Theemail module didn't properly quote newlines for email headers whenserializing an email message allowing     for header injection when an emailis serialized. (CVE-2024-6923)

    There is a LOW severity vulnerability affecting CPython, specifically the'http.cookies' standard library     module.

    When parsing cookies that contained backslashes for quoted characters inthe cookie value, the parser would     use an algorithm with quadraticcomplexity, resulting in excess CPU resources being used while parsing     thevalue. (CVE-2024-7592)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the python3 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    The urllib.parse.urlsplit() and urlparse() functions improperly validated bracketed hosts (`[]`), allowing     hosts that weren't IPv6 or IPvFuture. This behavior was not conformant to RFC 3986 and potentially enabled     SSRF if a URL is processed by more than one URL parser.(CVE-2024-11168)

Tenable has extracted the preceding description block directly from the EulerOS python3 security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-900 advisory.

    The urllib.parse.urlsplit() and urlparse() functions improperly validated bracketed hosts (`[]`), allowing     hosts that weren't IPv6 or IPvFuture. This behavior was not conformant to RFC 3986 and potentially enabled     SSRF if a URL is processed by more than one URL parser. (CVE-2024-11168)

    A vulnerability has been found in the CPython `venv` module and CLI where path names provided when     creating a virtual environment were not quoted properly, allowing the creator to inject commands into     virtual environment activation scripts (ie source venv/bin/activate). This means that attacker-     controlled virtual environments are able to run commands when the virtual environment is activated.
    Virtual environments which are not created by an attacker or which aren't activated before being used (ie     ./venv/bin/python) are not affected. (CVE-2024-9287)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2025:1041-1 advisory.

    - CVE-2024-11168: Fixed improper validation of IPv6 and IPvFuture addresses (bsc#1233307).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2024-9439:09 advisory.

    python: Virtual environment (venv) activation scripts don't quote paths     (CVE-2024-9287)         python: Improper validation of IPv6 and IPvFuture addresses (CVE-2024-11168)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4354 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4354-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                       Andrej Shadura     October 31, 2025                              https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : pypy3     Version        : 7.3.5+dfsg-2+deb11u5     CVE ID         : CVE-2024-6232 CVE-2024-6923 CVE-2024-7592 CVE-2024-11168                      CVE-2025-0938 CVE-2025-1795 CVE-2025-6069 CVE-2025-8291

    This upload fixes a few of security issues in the Python standard library     included with PyPy, an alternative implementation of the Python 3 language.

    CVE-2024-6232

        The tarfile module used to parse tar parsed header values with regular         expressions that allowed for backtracking, which could be used to cause         denial of service via specifically-crafted tar archives (ReDoS). Since         tar headers have a well-known format that doesn't require backtracking         to parse reliably, the new method of parsing only requires a single pass         over a byte stream.

    CVE-2024-6923

        The email module didnt properly quote newlines when serialising         email messages, which could be used to inject newlines that would         affect the interpretation of the email headers. An attacker could         cause some email headers to be completely skipped or potentially         hide malicious headers within other headers.

    CVE-2024-7592

        The http.cookies, when parsing cookies that contained backslashes         for quoted characters in the cookie value, would use an algorithm         with quadratic complexity, resulting in excess CPU resources being         used while parsing the value. E.g. parsing a 20000+ byte cookie         would take about a second (ReDoS).

    CVE-2024-11168 and CVE-2025-0938

        The urllib.parse.urlsplit and urlparse functions improperly validated         domain names that included square brackets allowing hosts that         weren't IPv6 or IPvFuture.

    CVE-2025-1795

        In the email module, during an address list folding, when a separating         comma ended up on a folded line and that line is to be Unicode-encoded,         then the separator itself was also Unicode-encoded. Expected behavior         is that the separating comma remains a plan comma. This could result         in the address header being misinterpreted by some mail servers.

    CVE-2025-6069

        The html.parser.HTMLParser class had worse-case quadratic complexity         when processing certain crafted malformed inputs potentially leading         to amplified denial-of-service.

    CVE-2025-8291

        The zipfile module would not check the validity of the ZIP64 End of         Central Directory (EOCD).
        Locator record offset value would not be used to locate the ZIP64         EOCD record, but instead the ZIP64 EOCD record would be assumed         to be the previous record in the ZIP archive. This could be abused         to create ZIP archives that are handled differently by the zipfile         module compared to other ZIP implementations. Remediation maintains         this behavior, but checks that the offset specified in the ZIP64         EOCD Locator record matches the expected value.

    For Debian 11 bullseye, these problems have been fixed in version     7.3.5+dfsg-2+deb11u5.

    We recommend that you upgrade your pypy3 packages.

    For the detailed security status of pypy3 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/pypy3

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-23530 advisory.

    mod_wsgi     numpy     python39     [3.9.25-2]
    - Add explicit BR: libxcrypt-devel
    - Properly apply exported CFLAGS for dtrace/systemtap builds
    - Update to Python 3.9.25
    - Move _sysconfigdata_d_linux*.py to the debug subpackage
    - Fedora contributions by:
          Bjorn Esser <besser82@fedoraproject.org>           Charalampos Stratakis <cstratak@redhat.com>           Karolina Surma <ksurma@redhat.com>           Tomas Orsava <torsava@redhat.com>           Tomas Hrnciar <thrnciar@redhat.com>     Resolves: RHEL-128539

    python3x-pip     python3x-setuptools     python3x-six     python-cffi     python-chardet     python-cryptography     python-idna     python-lxml     python-ply     python-psutil     python-psycopg2     python-pycparser     python-PyMySQL     python-pysocks     python-requests     python-toml     python-urllib3     python-wheel     PyYAML     scipy     Cython     pybind11     pytest     python3x-pyparsing     python-attrs     python-iniconfig     python-more-itertools     python-packaging     python-pluggy     python-py     python-wcwidth

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AOS installed on the remote host is prior to 7.5.1. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-7.5.1 advisory.

  - A vulnerability has been found in GNU Binutils 2.45. The affected element is the function elf_swap_shdr in     the library bfd/elfcode.h of the component Linker. The manipulation leads to heap-based buffer overflow.
    The attack must be carried out locally. The exploit has been disclosed to the public and may be used. The     identifier of the patch is 9ca499644a21ceb3f946d1c179c38a83be084490. To fix this issue, it is recommended     to deploy a patch. The code maintainer replied with [f]ixed for 2.46. (CVE-2025-11083)

  - Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in     Apache Commons FileUpload. This issue affects Apache Commons FileUpload: from 1.0 before 1.6; from     2.0.0-M1 before 2.0.0-M4. Users are recommended to upgrade to versions 1.6 or 2.0.0-M4, which fix the     issue. (CVE-2025-48976)

  - The urllib.parse.urlsplit() and urlparse() functions improperly validated bracketed hosts (`[]`), allowing     hosts that weren't IPv6 or IPvFuture. This behavior was not conformant to RFC 3986 and potentially enabled     SSRF if a URL is processed by more than one URL parser. (CVE-2024-11168)

  - CPython 3.9 and earlier doesn't disallow configuring an empty list ([]) for     SSLContext.set_npn_protocols() which is an invalid value for the underlying OpenSSL API. This results in a     buffer over-read when NPN is used (see CVE-2024-5535 for OpenSSL). This vulnerability is of low severity     due to NPN being not widely used and specifying an empty list likely being uncommon in-practice (typically     a protocol name would be configured). (CVE-2024-5642)

  - A vulnerability has been found in the CPython `venv` module and CLI where path names provided when     creating a virtual environment were not quoted properly, allowing the creator to inject commands into     virtual environment activation scripts (ie source venv/bin/activate). This means that attacker-     controlled virtual environments are able to run commands when the virtual environment is activated.
    Virtual environments which are not created by an attacker or which aren't activated before being used (ie     ./venv/bin/python) are not affected. (CVE-2024-9287)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
212566	SUSE SLES12 Security Update : python (SUSE-SU-2024:4165-1)	Nessus	SuSE Local Security Checks	2024/12/12	2026/1/21	medium
213688	openSUSE 15 Security Update : python39 (SUSE-SU-2025:0047-1)	Nessus	SuSE Local Security Checks	2025/1/10	2026/1/21	medium
216814	Amazon Linux 2 : python3 (ALAS-2025-2754)	Nessus	Amazon Linux Local Security Checks	2025/2/26	2026/1/21	medium
232954	EulerOS 2.0 SP12 : python3 (EulerOS-SA-2025-1304)	Nessus	Huawei Local Security Checks	2025/3/20	2025/3/20	medium
232971	EulerOS 2.0 SP12 : python3 (EulerOS-SA-2025-1303)	Nessus	Huawei Local Security Checks	2025/3/20	2025/3/20	medium
233383	Amazon Linux 2023 : python3, python3-devel, python3-idle (ALAS2023-2025-900)	Nessus	Amazon Linux Local Security Checks	2025/3/27	2026/1/21	medium
233456	SUSE SLES12 Security Update : python3 (SUSE-SU-2025:1041-1)	Nessus	SuSE Local Security Checks	2025/3/28	2026/1/21	medium
234148	EulerOS 2.0 SP11 : python3 (EulerOS-SA-2025-1374)	Nessus	Huawei Local Security Checks	2025/4/11	2026/1/21	medium
234174	EulerOS 2.0 SP11 : python3 (EulerOS-SA-2025-1373)	Nessus	Huawei Local Security Checks	2025/4/11	2026/1/21	medium
292834	MiracleLinux 9 : python3.9-3.9.21-1.el9_5 (AXSA:2024-9439:09)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	medium
272097	Debian dla-4354 : pypy3 - security update	Nessus	Debian Local Security Checks	2025/10/31	2025/10/31	medium
279709	Oracle Linux 8 : python39:3.9 (ELSA-2025-23530)	Nessus	Oracle Linux Local Security Checks	2025/12/24	2026/2/24	medium
305057	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-7.5.1)	Nessus	Misc.	2026/4/6	2026/4/7	medium

检测

插件搜索

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium