According to the versions of the python3 packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP     server that an HTTP client (such as web browser) connects to, could trigger a Regular Expression Denial of     Service (ReDOS) during an authentication request with a specially crafted payload that is sent by the     server to the client. The greatest threat that this flaw poses is to application availability.
    (CVE-2021-3733)

  - A flaw was found in python. An improperly handled HTTP response in the HTTP client code of python may     allow a remote attacker, who controls the HTTP server, to make the client script enter an infinite loop,     consuming CPU time. The highest threat from this vulnerability is to system availability. (CVE-2021-3737)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the python packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP     server that an HTTP client (such as web browser) connects to, could trigger a Regular Expression Denial of     Service (ReDOS) during an authentication request with a specially crafted payload that is sent by the     server to the client. The greatest threat that this flaw poses is to application availability.
    (CVE-2021-3733)

  - A flaw was found in python. An improperly handled HTTP response in the HTTP client code of python may     allow a remote attacker, who controls the HTTP server, to make the client script enter an infinite loop,     consuming CPU time. The highest threat from this vulnerability is to system availability. (CVE-2021-3737)

  - A flaw was found in Python, specifically in the FTP (File Transfer Protocol) client library in PASV     (passive) mode. The issue is how the FTP client trusts the host from the PASV response by default. This     flaw allows an attacker to set up a malicious FTP server that can trick FTP clients into connecting back     to a given IP address and port. This vulnerability could lead to FTP client scanning ports, which     otherwise would not have been possible. (CVE-2021-4189)

  - A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform     Resource Locator (URL) strings into components. The issue involves how the urlparse method does not     sanitize input and allows characters like '\r' and '\n' in the URL path. This flaw allows an attacker to     input a crafted URL, leading to injection attacks. This flaw affects Python versions prior to 3.10.0b1,     3.9.5, 3.8.11, 3.7.11 and 3.6.14. (CVE-2022-0391)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:1485-1 advisory.

  - A flaw was found in python-pip in the way it handled Unicode separators in git references. A remote     attacker could possibly use this issue to install a different revision on a repository. The highest threat     from this vulnerability is to data integrity. This is fixed in python-pip version 21.1. (CVE-2021-3572)

  - There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP     server that an HTTP client (such as web browser) connects to, could trigger a Regular Expression Denial of     Service (ReDOS) during an authentication request with a specially crafted payload that is sent by the     server to the client. The greatest threat that this flaw poses is to application availability.
    (CVE-2021-3733)

  - A flaw was found in python. An improperly handled HTTP response in the HTTP client code of python may     allow a remote attacker, who controls the HTTP server, to make the client script enter an infinite loop,     consuming CPU time. The highest threat from this vulnerability is to system availability. (CVE-2021-3737)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:3489-1 advisory.

  - Denial of service when identifying crafted invalid RFCs [fedora-all] (CVE-2021-3733)

  - client can enter an infinite loop on a 100 Continue response from the server [fedora-all] (CVE-2021-3737)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:4104-1 advisory.

    - CVE-2021-3426: Fixed information disclosure via pydoc (bsc#1183374).
    - CVE-2021-3733: Fixed infinitely reading potential HTTP headers after a 100 Continue status response from     the server (bsc#1189241).
    - CVE-2021-3737: Fixed ReDoS in urllib.request (bsc#1189287).

    - We do not require python-rpm-macros package (bsc#1180125).
    - Use versioned python-Sphinx to avoid dependency on other version of Python (bsc#1183858).
    - Stop providing 'python' symbol, which means python2 currently (bsc#1185588).
    - Modify Lib/ensurepip/__init__.py to contain the same version numbers as are in reality the ones in the     bundled wheels (bsc#1187668).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-1986 advisory.

    - Security fix for CVE-2021-4189: ftplib should not use the host from the PASV response     Resolves: rhbz#2036020

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:1986 advisory.

    Python is an interpreted, interactive, object-oriented programming language, which includes modules,     classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to     many system calls and libraries, as well as to various windowing systems.

    Security Fix(es):

    * python: ftplib should not use the host from the PASV response (CVE-2021-4189)

    * python: urllib: HTTP client possible infinite loop on a 100 Continue response (CVE-2021-3737)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.6 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2022:1821 advisory.

    * python: urllib: Regular expression DoS in AbstractBasicAuthHandler (CVE-2021-3733)

    * python: ftplib should not use the host from the PASV response (CVE-2021-4189)

    * python-lxml: HTML Cleaner allows crafted and SVG embedded scripts to pass through (CVE-2021-43818)

    * python: urllib.parse does not sanitize URLs containing ASCII newline and tabs (CVE-2022-0391)

    * python: urllib: HTTP client possible infinite loop on a 100 Continue response (CVE-2021-3737)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of python27 installed on the remote host is prior to 2.7.18-2.142. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2022-1593 advisory.

    In Python3's Lib/test/multibytecodec_support.py CJK codec tests call eval() on content retrieved via HTTP.
    (CVE-2020-27619)

    The package python/cpython is vulnerable to Web Cache Poisoning via urllib.parse.parse_qsl and     urllib.parse.parse_qs by using a vector called parameter cloaking. When the attacker can separate query     parameters using a semicolon (;), they can cause a difference in the interpretation of the request between     the proxy (running with default configuration) and the server. This can result in malicious requests being     cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and     therefore would not include it in a cache key of an unkeyed parameter. (CVE-2021-23336)

    There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP     server that an HTTP client (such as web browser) connects to, could trigger a Regular Expression Denial of     Service (ReDOS) during an authentication request with a specially crafted payload that is sent by the     server to the client. The greatest threat that this flaw poses is to application availability.
    (CVE-2021-3733)

    A flaw was found in python. An improperly handled HTTP response in the HTTP client code of python may     allow a remote attacker, who controls the HTTP server, to make the client script enter an infinite loop,     consuming CPU time. The highest threat from this vulnerability is to system availability. (CVE-2021-3737)

    ftplib should not use the host from the PASV response (CVE-2021-4189)

    A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform     Resource Locator (URL) strings into components. The issue involves how the urlparse method does not     sanitize input and allows characters like r and n in the URL path. This flaw allows an attacker to input a     crafted URL, leading to injection attacks. (CVE-2022-0391)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
159849	EulerOS Virtualization 2.10.0 : python3 (EulerOS-SA-2022-1411)	Nessus	Huawei Local Security Checks	2022/4/18	2023/11/1	high
170793	EulerOS Virtualization 3.0.2.2 : python (EulerOS-SA-2023-1284)	Nessus	Huawei Local Security Checks	2023/1/30	2023/9/5	high
160461	SUSE SLED15 / SLES15 Security Update : python39 (SUSE-SU-2022:1485-1)	Nessus	SuSE Local Security Checks	2022/5/3	2023/7/14	medium
154288	openSUSE 15 Security Update : python (openSUSE-SU-2021:3489-1)	Nessus	SuSE Local Security Checks	2021/10/21	2023/11/28	high
156148	SUSE SLED15: libpython3_6m1_0 / python3 / python3-base / python3-curses / etc (SUSE-SU-2021:4104-1)	Nessus	SuSE Local Security Checks	2021/12/17	2026/6/26	medium
161323	Oracle Linux 8 : python3 (ELSA-2022-1986)	Nessus	Oracle Linux Local Security Checks	2022/5/18	2024/10/22	medium
161022	RHEL 8 : python3 (RHSA-2022:1986)	Nessus	Red Hat Local Security Checks	2022/5/11	2025/3/15	medium
161115	AlmaLinux 8 : python27:2.7 (ALSA-2022:1821)	Nessus	Alma Linux Local Security Checks	2022/5/12	2025/1/13	high
162008	Amazon Linux AMI : python27 (ALAS-2022-1593)	Nessus	Amazon Linux Local Security Checks	2022/6/10	2024/12/11	critical

检测

插件搜索

high

high

medium

high

medium

medium

medium

high

critical