The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2025:0151 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2024-47081:
    Requests is a HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc     credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4     to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with     `trust_env=False` on one's Requests Session.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2025:14750 advisory.

    * requests: Requests vulnerable to .netrc credentials leak via malicious URLs (CVE-2024-47081)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:15614 advisory.

    The fence-agents packages provide a collection of scripts for handling remote power management for cluster     devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster.

    Security Fix(es):

    * requests: Requests vulnerable to .netrc credentials leak via malicious URLs (CVE-2024-47081)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:15618 advisory.

    The resource-agents packages provide the Pacemaker and RGManager service managers with a set of scripts.
    These scripts interface with several services to allow operating in a high-availability (HA) environment.

    Security Fix(es):

    * requests: Requests vulnerable to .netrc credentials leak via malicious URLs (CVE-2024-47081)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the python-pip packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    Requests is a HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc     credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4     to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with     `trust_env=False` on one's Requests Session.(CVE-2024-47081)

Tenable has extracted the preceding description block directly from the EulerOS python-pip security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the python-requests packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    Requests is a HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc     credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4     to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with     `trust_env=False` on one's Requests Session.(CVE-2024-47081)

Tenable has extracted the preceding description block directly from the EulerOS python-requests security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the python3 package has been released.

According to the versions of the python-requests package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

    Requests is a HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc     credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4     to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with     `trust_env=False` on one's Requests Session.(CVE-2024-47081)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization python-requests security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2025-10817:10 advisory.

    * requests: Requests vulnerable to .netrc credentials leak via malicious URLs (CVE-2024-47081)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the python-pip packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

    urllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, it is possible to disable     redirects for all requests by instantiating a PoolManager and specifying retries in a way that disable     redirects. By default, requests and botocore users are not affected. An application attempting to mitigate     SSRF or open redirect vulnerabilities by disabling redirects at the PoolManager level will remain     vulnerable. This issue has been patched in version 2.5.0.(CVE-2025-50181)

    A vulnerability was identified in the kjd/idna library, specifically within the `idna.encode()` function,     affecting version 3.6. The issue arises from the function's handling of crafted input strings, which can     lead to quadratic complexity and consequently, a denial of service condition. This vulnerability is     triggered by a crafted input that causes the `idna.encode()` function to process the input with     considerable computational load, significantly increasing the processing time in a quadratic manner     relative to the input size.(CVE-2024-3651)

    Requests is a HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc     credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4     to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with     `trust_env=False` on one's Requests Session.(CVE-2024-47081)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization python-pip security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the python-pip packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

    urllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, it is possible to disable     redirects for all requests by instantiating a PoolManager and specifying retries in a way that disable     redirects. By default, requests and botocore users are not affected. An application attempting to mitigate     SSRF or open redirect vulnerabilities by disabling redirects at the PoolManager level will remain     vulnerable. This issue has been patched in version 2.5.0.(CVE-2025-50181)

    Requests is a HTTP library. Since Requests 2.3.0, Requests has been leaking Proxy-Authorization headers to     destination servers when redirected to an HTTPS endpoint. This is a product of how we use     `rebuild_proxies` to reattach the `Proxy-Authorization` header to requests. For HTTP connections sent     through the tunnel, the proxy will identify the header in the request itself and remove it prior to     forwarding to the destination server. However when sent over HTTPS, the `Proxy-Authorization` header must     be sent in the CONNECT request as the proxy has no visibility into the tunneled request. This results in     Requests forwarding proxy credentials to the destination server unintentionally, allowing a malicious     actor to potentially exfiltrate sensitive information. This issue has been patched in version     2.31.0.(CVE-2023-32681)

    When extracting a tar archive pip may not check symbolic links point into the extraction directory if the     tarfile module doesn't implement PEP 706.Note that upgrading pip to a 'fixed' version for this     vulnerability doesn't fix all known vulnerabilities that are remediated by using a Python version that     implements PEP 706.Note that this is a vulnerability in pip's fallback implementation of tar extraction     for Python versions that don't implement PEP 706 and therefore are not secure to all vulnerabilities in     the Python 'tarfile' module. If you're using a Python version that implements PEP 706 then pip doesn't use     the 'vulnerable' fallback code.Mitigations include upgrading to a version of pip that includes the fix,     upgrading to a Python version that implements PEP 706 (Python =3.9.17, =3.10.12, =3.11.4, or     =3.12),applying the linked patch, or inspecting source distributions (sdists) before installation as is     already a best-practice.(CVE-2025-8869)

    Requests is a HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc     credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4     to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with     `trust_env=False` on one's Requests Session.(CVE-2024-47081)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization python-pip security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AOS installed on the remote host is prior to 7.0.1.9. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-7.0.1.9 advisory.

  - There exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregate terms could     exceed the number of columns available. This could lead to a memory corruption issue. We recommend     upgrading to version 3.50.2 or above. (CVE-2025-6965)

  - Requests is a HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc     credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4     to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with     `trust_env=False` on one's Requests Session. (CVE-2024-47081)

  - The regcomp function in the GNU C library version from 2.4 to 2.41 is subject to a double free if some     previous allocation fails. It can be accomplished either by a malloc failure or by using an interposed     malloc that injects random malloc failures. The double free can allow buffer manipulation depending of how     the regex is constructed. This issue affects all architectures and ABIs supported by the GNU C library.
    (CVE-2025-8058)

  - Perl threads have a working directory race condition where file operations may target unintended paths. If     a directory handle is open at thread creation, the process-wide current working directory is temporarily     changed in order to clone that handle for the new thread, which is visible from any third (or more) thread     already running. This may lead to unintended operations such as loading code or accessing files from     unexpected locations, which a local attacker may be able to exploit. The bug was introduced in commit     11a11ecf4bea72b17d250cfb43c897be1341861e and released in Perl version 5.13.6 (CVE-2025-40909)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
261680	Alibaba Cloud Linux 3 : 0151: resource-agents (ALINUX3-SA-2025:0151)	Nessus	Alibaba Cloud Linux Local Security Checks	2025/9/8	2025/9/8	medium
261727	RockyLinux 8 : fence-agents (RLSA-2025:14750)	Nessus	Rocky Linux Local Security Checks	2025/9/8	2025/9/8	medium
264483	RHEL 8 : fence-agents (RHSA-2025:15614)	Nessus	Red Hat Local Security Checks	2025/9/10	2025/9/10	medium
264492	RHEL 8 : resource-agents (RHSA-2025:15618)	Nessus	Red Hat Local Security Checks	2025/9/10	2025/9/10	medium
270050	EulerOS 2.0 SP11 : python-pip (EulerOS-SA-2025-2211)	Nessus	Huawei Local Security Checks	2025/10/11	2025/10/11	medium
270053	EulerOS 2.0 SP11 : python-requests (EulerOS-SA-2025-2212)	Nessus	Huawei Local Security Checks	2025/10/11	2025/10/11	medium
274944	EulerOS 2.0 SP12 : python-pip (EulerOS-SA-2025-2340)	Nessus	Huawei Local Security Checks	2025/11/12	2025/11/12	medium
276711	Photon OS 4.0: Python3 PHSA-2025-4.0-0876	Nessus	PhotonOS Local Security Checks	2025/11/25	2025/11/25	medium
279302	EulerOS Virtualization 2.13.0 : python-requests (EulerOS-SA-2025-2597)	Nessus	Huawei Local Security Checks	2025/12/18	2025/12/18	medium
283110	MiracleLinux 8 : fence-agents-4.2.1-129.el8_10.14 (AXSA:2025-10817:10)	Nessus	Miracle Linux Local Security Checks	2026/1/13	2026/1/13	medium
297379	EulerOS Virtualization 2.10.0 : python-pip (EulerOS-SA-2026-1194)	Nessus	Huawei Local Security Checks	2026/1/31	2026/1/31	medium
302731	EulerOS Virtualization 2.12.1 : python-pip (EulerOS-SA-2026-1457)	Nessus	Huawei Local Security Checks	2026/3/17	2026/3/17	medium
271417	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-7.0.1.9)	Nessus	Misc.	2025/10/24	2025/10/24	high

检测

插件搜索

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

high