The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2025:15723 advisory.

    Python is an interpreted, interactive, object-oriented programming language, which includes modules,     classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to     many system calls and libraries, as well as to various windowing systems.

    Security Fix(es):

    * requests: Requests vulnerable to .netrc credentials leak via malicious URLs (CVE-2024-47081)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the python-requests package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    Requests is a HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc     credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4     to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with     `trust_env=False` on one's Requests Session.(CVE-2024-47081)

Tenable has extracted the preceding description block directly from the EulerOS python-requests security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-2928 advisory.

    Requests is a HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc     credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4     to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with     `trust_env=False` on one's Requests Session. (CVE-2024-47081)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-12519 advisory.

    [2.25.1-10]
    - Security fix for CVE-2024-47081     Resolves: RHEL-105461

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2025:12519 advisory.

    * requests: Requests vulnerable to .netrc credentials leak via malicious URLs (CVE-2024-47081)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1110 advisory.

    Requests is a HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc     credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4     to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with     `trust_env=False` on one's Requests Session. (CVE-2024-47081)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2025:12519 advisory.

    * requests: Requests vulnerable to .netrc credentials leak via malicious URLs (CVE-2024-47081)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the python-pip packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    Requests is a HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc     credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4     to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with     `trust_env=False` on one's Requests Session.(CVE-2024-47081)

Tenable has extracted the preceding description block directly from the EulerOS python-pip security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the python-requests packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    Requests is a HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc     credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4     to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with     `trust_env=False` on one's Requests Session.(CVE-2024-47081)

Tenable has extracted the preceding description block directly from the EulerOS python-requests security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2025-13604 advisory.

    [2.32.4-1]
    - Update to 2.32.4
    - Security fix for CVE-2024-47081: .netrc credentials leak via malicious URLs     Resolves: RHEL-105460

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of AHV installed on the remote host is prior to 20230302.103072. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AHV-20230302.103072 advisory.

  - There exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregate terms could     exceed the number of columns available. This could lead to a memory corruption issue. We recommend     upgrading to version 3.50.2 or above. (CVE-2025-6965)

  - LZ4 before 1.9.2 has a heap-based buffer overflow in LZ4_write32 (related to LZ4_compress_destSize),     affecting applications that call LZ4_compress_fast with a large input. (This issue can also lead to data     corruption.) NOTE: the vendor states only a few specific / uncommon usages of the API are at risk.
    (CVE-2019-17543)

  - A use-after-free vulnerability was found in libxml2. This issue occurs when parsing XPath elements under     certain circumstances when the XML schematron has the <sch:name path=.../> schema elements. This flaw     allows a malicious actor to craft a malicious XML document used as input for libxml, resulting in the     program's crash using libxml or other possible undefined behaviors. (CVE-2025-49794)

  - A vulnerability was found in libxml2. Processing certain sch:name elements from the input XML file can     trigger a memory corruption issue. This flaw allows an attacker to craft a malicious XML input file that     can lead libxml to crash, resulting in a denial of service or other possible undefined behavior due to     sensitive data being corrupted in memory. (CVE-2025-49796)

  - A flaw was found in libxml2's xmlBuildQName function, where integer overflows in buffer size calculations     can lead to a stack-based buffer overflow. This issue can result in memory corruption or a denial of     service when processing crafted input. (CVE-2025-6021)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AOS installed on the remote host is prior to 6.10.1.10. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-6.10.1.10 advisory.

  - There exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregate terms could     exceed the number of columns available. This could lead to a memory corruption issue. We recommend     upgrading to version 3.50.2 or above. (CVE-2025-6965)

  - Requests is a HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc     credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4     to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with     `trust_env=False` on one's Requests Session. (CVE-2024-47081)

  - The regcomp function in the GNU C library version from 2.4 to 2.41 is subject to a double free if some     previous allocation fails. It can be accomplished either by a malloc failure or by using an interposed     malloc that injects random malloc failures. The double free can allow buffer manipulation depending of how     the regex is constructed. This issue affects all architectures and ABIs supported by the GNU C library.
    (CVE-2025-8058)

  - Perl threads have a working directory race condition where file operations may target unintended paths. If     a directory handle is open at thread creation, the process-wide current working directory is temporarily     changed in order to clone that handle for the new thread, which is visible from any third (or more) thread     already running. This may lead to unintended operations such as loading code or accessing files from     unexpected locations, which a local attacker may be able to exploit. The bug was introduced in commit     11a11ecf4bea72b17d250cfb43c897be1341861e and released in Perl version 5.13.6 (CVE-2025-40909)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
264788	RHEL 8 : python-requests (RHSA-2025:15723)	Nessus	Red Hat Local Security Checks	2025/9/15	2025/9/15	medium
264862	EulerOS 2.0 SP13 : python-requests (EulerOS-SA-2025-2139)	Nessus	Huawei Local Security Checks	2025/9/16	2025/9/16	medium
241752	Amazon Linux 2 : python-pip (ALAS-2025-2928)	Nessus	Amazon Linux Local Security Checks	2025/7/10	2025/7/14	medium
243398	Oracle Linux 9 : python-requests (ELSA-2025-12519)	Nessus	Oracle Linux Local Security Checks	2025/8/4	2025/8/4	medium
243399	AlmaLinux 9 : python-requests (ALSA-2025:12519)	Nessus	Alma Linux Local Security Checks	2025/8/4	2025/8/4	medium
243502	Amazon Linux 2023 : python3-requests, python3-requests+security, python3-requests+socks (ALAS2023-2025-1110)	Nessus	Amazon Linux Local Security Checks	2025/8/4	2025/8/4	medium
266698	RockyLinux 9 : python-requests (RLSA-2025:12519)	Nessus	Rocky Linux Local Security Checks	2025/10/6	2025/10/6	medium
270050	EulerOS 2.0 SP11 : python-pip (EulerOS-SA-2025-2211)	Nessus	Huawei Local Security Checks	2025/10/11	2025/10/11	medium
270058	EulerOS 2.0 SP11 : python-requests (EulerOS-SA-2025-2244)	Nessus	Huawei Local Security Checks	2025/10/11	2025/10/11	medium
248489	Oracle Linux 10 : python-requests (ELSA-2025-13604)	Nessus	Oracle Linux Local Security Checks	2025/8/12	2025/10/29	medium
269976	Nutanix AHV : Multiple Vulnerabilities (NXSA-AHV-20230302.103072)	Nessus	Misc.	2025/10/10	2025/10/10	high
271420	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-6.10.1.10)	Nessus	Misc.	2025/10/24	2025/10/24	high
274870	EulerOS 2.0 SP12 : python-pip (EulerOS-SA-2025-2371)	Nessus	Huawei Local Security Checks	2025/11/12	2025/11/12	medium

检测

插件搜索

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

high

high

medium