According to the versions of the python-urllib3 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    urllib3 is a user-friendly HTTP client library for Python. When using urllib3's proxy support with     `ProxyManager`, the `Proxy-Authorization` header is only sent to the configured proxy, as expected.
    However, when sending HTTP requests *without* using urllib3's proxy support, it's possible to accidentally     configure the `Proxy-Authorization` header even though it won't have any effect as the request is not     using a forwarding proxy or a tunneling proxy. In those cases, urllib3 doesn't treat the `Proxy-     Authorization` HTTP header as one carrying authentication material and thus doesn't strip the header on     cross-origin redirects. Because this is a highly unlikely scenario, we believe the severity of this     vulnerability is low for almost all users. Out of an abundance of caution urllib3 will automatically strip     the `Proxy-Authorization` header during cross-origin redirects to avoid the small chance that users are     doing this on accident. Users should use urllib3's proxy support or disable automatic redirects to achieve     safe processing of the `Proxy-Authorization` header, but we still decided to strip the header by default     in order to further protect users who aren't using the correct approach. We believe the number of usages     affected by this advisory is low. It requires all of the following to be true to be exploited: 1. Setting     the `Proxy-Authorization` header without using urllib3's built-in proxy support. 2. Not disabling HTTP     redirects. 3. Either not using an HTTPS origin server or for the proxy or target origin to redirect to a     malicious origin. Users are advised to update to either version 1.26.19 or version 2.2.2. Users unable to     upgrade may use the `Proxy-Authorization` header with urllib3's `ProxyManager`, disable HTTP redirects     using `redirects=False` when sending requests, or not user the `Proxy-Authorization` header as     mitigations.(CVE-2024-37891)

Tenable has extracted the preceding description block directly from the EulerOS python-urllib3 security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-730 advisory.

    urllib3 is a user-friendly HTTP client library for Python. When using urllib3's proxy support with     `ProxyManager`, the `Proxy-Authorization` header is only sent to the configured proxy, as expected.
    However, when sending HTTP requests *without* using urllib3's proxy support, it's possible to accidentally     configure the `Proxy-Authorization` header even though it won't have any effect as the request is not     using a forwarding proxy or a tunneling proxy. In those cases, urllib3 doesn't treat the `Proxy-     Authorization` HTTP header as one carrying authentication material and thus doesn't strip the header on     cross-origin redirects. Because this is a highly unlikely scenario, we believe the severity of this     vulnerability is low for almost all users. Out of an abundance of caution urllib3 will automatically strip     the `Proxy-Authorization` header during cross-origin redirects to avoid the small chance that users are     doing this on accident. Users should use urllib3's proxy support or disable automatic redirects to achieve     safe processing of the `Proxy-Authorization` header, but we still decided to strip the header by default     in order to further protect users who aren't using the correct approach. We believe the number of usages     affected by this advisory is low. It requires all of the following to be true to be exploited: 1. Setting     the `Proxy-Authorization` header without using urllib3's built-in proxy support. 2. Not disabling HTTP     redirects. 3. Either not using an HTTPS origin server or for the proxy or target origin to redirect to a     malicious origin. Users are advised to update to either version 1.26.19 or version 2.2.2. Users unable to     upgrade may use the `Proxy-Authorization` header with urllib3's `ProxyManager`, disable HTTP redirects     using `redirects=False` when sending requests, or not user the `Proxy-Authorization` header as     mitigations. (CVE-2024-37891)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2024:6311 advisory.

    * urllib3: proxy-authorization request header is not stripped during cross-origin redirects     (CVE-2024-37891)

    * pypa/setuptools: Remote code execution via download functions in the package_index module in     pypa/setuptools (CVE-2024-6345)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

urllib3 is a user-friendly HTTP client library for Python. When using urllib3's proxy support with 'ProxyManager', the 'Proxy-Authorization' header is only sent to the configured proxy, as expected. However, when sending HTTP requests without using urllib3's proxy support, it's possible to accidentally configure the 'Proxy-Authorization' header even though it won't have any effect as the request is not using a forwarding proxy or a tunneling proxy. In those cases, urllib3 doesn't treat the 'Proxy-Authorization' HTTP header as one carrying authentication material and thus doesn't strip the header on cross-origin redirects. 

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2024:0797 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2024-37891:
     urllib3 is a user-friendly HTTP client library for Python. When using urllib3's proxy support with     ProxyManager, the Proxy-Authorization header is only sent to the configured proxy, as expected. However,     when sending HTTP requests *without* using urllib3's proxy support, it's possible to accidentally     configure the Proxy-Authorization header even though it won't have any effect as the request is not using     a forwarding proxy or a tunneling proxy. In those cases, urllib3 doesn't treat the Proxy-Authorization     HTTP header as one carrying authentication material and thus doesn't strip the header on cross-origin     redirects. Because this is a highly unlikely scenario, we believe the severity of this vulnerability is     low for almost all users. Out of an abundance of caution urllib3 will automatically strip the Proxy-     Authorization header during cross-origin redirects to avoid the small chance that users are doing this on     accident. Users should use urllib3's proxy support or disable automatic redirects to achieve safe     processing of the Proxy-Authorization header, but we still decided to strip the header by default in order     to further protect users who aren't using the correct approach. We believe the number of usages affected     by this advisory is low. It requires all of the following to be true to be exploited: 1. Setting the     Proxy-Authorization header without using urllib3's built-in proxy support. 2. Not disabling HTTP     redirects. 3. Either not using an HTTPS origin server or for the proxy or target origin to redirect to a     malicious origin. Users are advised to update to either version 1.26.19 or version 2.2.2. Users unable to     upgrade may use the Proxy-Authorization header with urllib3's ProxyManager, disable HTTP redirects using     redirects=False when sending requests, or not user the Proxy-Authorization header as mitigations.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2024:0551 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2024-37891:
     urllib3 is a user-friendly HTTP client library for Python. When using urllib3's proxy support with     `ProxyManager`, the `Proxy-Authorization` header is only sent to the configured proxy, as expected.
    However, when sending HTTP requests *without* using urllib3's proxy support, it's possible to accidentally     configure the `Proxy-Authorization` header even though it won't have any effect as the request is not     using a forwarding proxy or a tunneling proxy. In those cases, urllib3 doesn't treat the `Proxy-     Authorization` HTTP header as one carrying authentication material and thus doesn't strip the header on     cross-origin redirects. Because this is a highly unlikely scenario, we believe the severity of this     vulnerability is low for almost all users. Out of an abundance of caution urllib3 will automatically strip     the `Proxy-Authorization` header during cross-origin redirects to avoid the small chance that users are     doing this on accident. Users should use urllib3's proxy support or disable automatic redirects to achieve     safe processing of the `Proxy-Authorization` header, but we still decided to strip the header by default     in order to further protect users who aren't using the correct approach. We believe the number of usages     affected by this advisory is low. It requires all of the following to be true to be exploited: 1. Setting     the `Proxy-Authorization` header without using urllib3's built-in proxy support. 2. Not disabling HTTP     redirects. 3. Either not using an HTTPS origin server or for the proxy or target origin to redirect to a     malicious origin. Users are advised to update to either version 1.26.19 or version 2.2.2. Users unable to     upgrade may use the `Proxy-Authorization` header with urllib3's `ProxyManager`, disable HTTP redirects     using `redirects=False` when sending requests, or not user the `Proxy-Authorization` header as     mitigations.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:8906 advisory.

    Red Hat Satellite is a system management solution that allows organizations to configure and maintain     their systems without the necessity to provide public Internet access to their servers or other client     systems. It performs provisioning and configuration management of predefined standard operating     environments.

    Security Fix(es):

    * mosquitto: sending specific sequences of packets may trigger memory leak     (CVE-2024-8376)
    * micromatch: vulnerable to Regular Expression Denial of Service (CVE-2024-4067)     urllib3: proxy-authorization request header is not stripped during cross-origin redirects (CVE-2024-37891)
    * node-tar: denial of service while parsing a tar file due to lack of folders depth validation     (CVE-2024-28863)
    * python-django: Potential denial-of-service in django.utils.html.urlize() (CVE-2024-38875)
    * python-django: Username enumeration through timing difference for users with unusable passwords     (CVE-2024-39329)
    * python-django: Potential directory-traversal in django.core.files.storage.Storage.save()     (CVE-2024-39330)
    * python-django: Potential denial-of-service in django.utils.translation.get_supported_language_variant()     (CVE-2024-39614)
    * github.com/jaraco/zipp: Denial of Service (infinite loop) via crafted zip file in jaraco/zipp     (CVE-2024-5569)
    * puppet-foreman: An authentication bypass vulnerability exists in Foreman (CVE-2024-7012)
    * python-django: Potential SQL injection in QuerySet.values() and values_list() (CVE-2024-42005)
    * grpc: client communicating with a HTTP/2 proxy can poison the HPACK table between the proxy and the     backend (CVE-2024-7246)
    * puppet-pulpcore: An authentication bypass vulnerability exists in pulpcore (CVE-2024-7923)
    * foreman: Read-only access to entire DB from templates (CVE-2024-8553)

    Users of Red Hat Satellite are advised to upgrade to these updated packages, which fix these bugs.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 7.02, has python-urllib3 packages installed that are affected by multiple vulnerabilities:

  - urllib3 is a user-friendly HTTP client library for Python. urllib3 doesn't treat the `Cookie` HTTP header     special or provide any helpers for managing cookies over HTTP, that is the responsibility of the user.
    However, it is possible for a user to specify a `Cookie` header and unknowingly leak information via HTTP     redirects to a different origin if that user doesn't disable redirects explicitly. This issue has been     patched in urllib3 version 1.26.17 or 2.0.5. (CVE-2023-43804)

  - urllib3 is a user-friendly HTTP client library for Python. urllib3 previously wouldn't remove the HTTP     request body when an HTTP redirect response using status 301, 302, or 303 after the request had its method     changed from one that could accept a request body (like `POST`) to `GET` as is required by HTTP RFCs.
    Although this behavior is not specified in the section for redirects, it can be inferred by piecing     together information from different sections and we have observed the behavior in other major HTTP client     implementations like curl and web browsers. Because the vulnerability requires a previously trusted     service to become compromised in order to have an impact on confidentiality we believe the exploitability     of this vulnerability is low. Additionally, many users aren't putting sensitive data in HTTP request     bodies, if this is the case then this vulnerability isn't exploitable. Both of the following conditions     must be true to be affected by this vulnerability: 1. Using urllib3 and submitting sensitive information     in the HTTP request body (such as form data or JSON) and 2. The origin service is compromised and starts     redirecting using 301, 302, or 303 to a malicious peer or the redirected-to service becomes compromised.
    This issue has been addressed in versions 1.26.18 and 2.0.7 and users are advised to update to resolve     this issue. Users unable to update should disable redirects for services that aren't expecting to respond     with redirects with `redirects=False` and disable automatic redirects with `redirects=False` and handle     301, 302, and 303 redirects manually by stripping the HTTP request body. (CVE-2023-45803)

  - urllib3 is a user-friendly HTTP client library for Python. When using urllib3's proxy support with     `ProxyManager`, the `Proxy-Authorization` header is only sent to the configured proxy, as expected.
    However, when sending HTTP requests *without* using urllib3's proxy support, it's possible to accidentally     configure the `Proxy-Authorization` header even though it won't have any effect as the request is not     using a forwarding proxy or a tunneling proxy. In those cases, urllib3 doesn't treat the `Proxy-     Authorization` HTTP header as one carrying authentication material and thus doesn't strip the header on     cross-origin redirects. Because this is a highly unlikely scenario, we believe the severity of this     vulnerability is low for almost all users. Out of an abundance of caution urllib3 will automatically strip     the `Proxy-Authorization` header during cross-origin redirects to avoid the small chance that users are     doing this on accident. Users should use urllib3's proxy support or disable automatic redirects to achieve     safe processing of the `Proxy-Authorization` header, but we still decided to strip the header by default     in order to further protect users who aren't using the correct approach. We believe the number of usages     affected by this advisory is low. It requires all of the following to be true to be exploited: 1. Setting     the `Proxy-Authorization` header without using urllib3's built-in proxy support. 2. Not disabling HTTP     redirects. 3. Either not using an HTTPS origin server or for the proxy or target origin to redirect to a     malicious origin. Users are advised to update to either version 1.26.19 or version 2.2.2. Users unable to     upgrade may use the `Proxy-Authorization` header with urllib3's `ProxyManager`, disable HTTP redirects     using `redirects=False` when sending requests, or not user the `Proxy-Authorization` header as     mitigations. (CVE-2024-37891)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:6765 advisory.

    Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing     IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to     individual teams, while automation developers retain the freedom to write tasks that leverage existing     knowledge without the overhead. Ansible Automation Platform makes it possible for users across an     organization to share, vet, and manage automation content by means of a simple, powerful, and agentless     language.

    Security Fix(es):

    * python3-pulpcore/python39-pulpcore: RBAC permissions incorrectly assigned in tasks that create objects     (CVE-2024-7143)
    * python3-urllib3/python39-urllib3: urllib3: proxy-authorization request header is not stripped during     cross-origin redirects (CVE-2024-37891)
    * receptor: golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses     (CVE-2024-24790)
    * receptor: golang: net: malformed DNS message can cause infinite loop (CVE-2024-24788)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Updates and fixes for automation controller:
    * Updated fallback to use RHSM subscription credential for shipping analytics data if analytics gathering     is enabled (AAP-30228)
    * Upgraded 'channels-redis' library to fix Redis connection leak (AAP-30124)
    * automation-controller has been updated to 4.5.11

    Additional fixes:
    * python3/python39-django has been updated to 4.2.16
    * python3/python39-pulpcore has been updated to 3.28.32
    * python3/python39-urllib3 has been updated to 1.26.20
    * receptor has been updated to 1.4.8-1.1

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The versions of Oracle Database Server installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2025 CPU advisory.

  - Vulnerability in the Oracle Database component of Oracle Database Server.  Supported versions that     are affected are 19.3-19.27 and  23.4-23.8. Easily exploitable vulnerability allows low privileged     attacker having Create Session, Create Procedure privilege with network access via Oracle Net to     compromise Oracle Database.  Successful attacks of this vulnerability can result in takeover of Oracle     Database. (CVE-2025-30751)

  - Vulnerability in the Java VM component of Oracle Database Server.  Supported versions that are affected     are 19.3-19.27 and  21.3-21.18. Easily exploitable vulnerability allows low privileged attacker having     Create Session, Create Procedure privilege with network access via Oracle Net to compromise Java VM.
    While the vulnerability is in Java VM, attacks may significantly impact additional products (scope change).
    Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete     access to all Java VM accessible data. (CVE-2025-50069)

  - Vulnerability in the Oracle Text (FreeType) component of Oracle Database Server.  Supported versions     that are affected are 19.3-19.27, 21.3-21.18 and  23.4-23.8. Difficult to exploit vulnerability allows     low privileged attacker having Create Session, Create Index privilege with network access via Oracle Net     to compromise Oracle Text (FreeType).  Successful attacks of this vulnerability can result in takeover     of Oracle Text (FreeType). (CVE-2025-27363)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AOS installed on the remote host is prior to 6.8.1.6. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-6.8.1.6 advisory.

  - An issue was discovered in libexpat before 2.6.3. nextScaffoldPart in xmlparse.c can have an integer     overflow for m_groupSize on 32-bit platforms (where UINT_MAX equals SIZE_MAX). (CVE-2024-45492)

  - A vulnerability was found in libndp. This flaw allows a local malicious user to cause a buffer overflow in     NetworkManager, triggered by sending a malformed IPv6 router advertisement packet. This issue occurred as     libndp was not correctly validating the route length information. (CVE-2024-5564)

  - A vulnerability was found in GNU Nano that allows a possible privilege escalation through an insecure     temporary file. If Nano is killed while editing, a file it saves to an emergency file with the permissions     of the running user provides a window of opportunity for attackers to escalate privileges through a     malicious symlink. (CVE-2024-5742)

  - A vulnerability was found in Performance Co-Pilot (PCP). This flaw allows an attacker to send specially     crafted data to the system, which could cause the program to misbehave or crash. (CVE-2024-45769)

  - A vulnerability was found in Performance Co-Pilot (PCP). This flaw can only be exploited if an attacker     has access to a compromised PCP system account. The issue is related to the pmpost tool, which is used to     log messages in the system. Under certain conditions, it runs with high-level privileges. (CVE-2024-45770)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2024:0398 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2024-37891:
     urllib3 is a user-friendly HTTP client library for Python. When using urllib3's proxy support with     ProxyManager, the Proxy-Authorization header is only sent to the configured proxy, as expected. However,     when sending HTTP requests *without* using urllib3's proxy support, it's possible to accidentally     configure the Proxy-Authorization header even though it won't have any effect as the request is not using     a forwarding proxy or a tunneling proxy. In those cases, urllib3 doesn't treat the Proxy-Authorization     HTTP header as one carrying authentication material and thus doesn't strip the header on cross-origin     redirects. Because this is a highly unlikely scenario, we believe the severity of this vulnerability is     low for almost all users. Out of an abundance of caution urllib3 will automatically strip the Proxy-     Authorization header during cross-origin redirects to avoid the small chance that users are doing this on     accident. Users should use urllib3's proxy support or disable automatic redirects to achieve safe     processing of the Proxy-Authorization header, but we still decided to strip the header by default in order     to further protect users who aren't using the correct approach. We believe the number of usages affected     by this advisory is low. It requires all of the following to be true to be exploited: 1. Setting the     Proxy-Authorization header without using urllib3's built-in proxy support. 2. Not disabling HTTP     redirects. 3. Either not using an HTTPS origin server or for the proxy or target origin to redirect to a     malicious origin. Users are advised to update to either version 1.26.19 or version 2.2.2. Users unable to     upgrade may use the Proxy-Authorization header with urllib3's ProxyManager, disable HTTP redirects using     redirects=False when sending requests, or not user the Proxy-Authorization header as mitigations.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2024:0182 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2023-43804:
    urllib3 is a user-friendly HTTP client library for Python. urllib3 doesn't treat the `Cookie` HTTP header     special or provide any helpers for managing cookies over HTTP, that is the responsibility of the user.
    However, it is possible for a user to specify a `Cookie` header and unknowingly leak information via HTTP     redirects to a different origin if that user doesn't disable redirects explicitly. This issue has been     patched in urllib3 version 1.26.17 or 2.0.5.

    CVE-2023-45803:
    urllib3 is a user-friendly HTTP client library for Python. urllib3 previously wouldn't remove the HTTP     request body when an HTTP redirect response using status 301, 302, or 303 after the request had its method     changed from one that could accept a request body (like `POST`) to `GET` as is required by HTTP RFCs.
    Although this behavior is not specified in the section for redirects, it can be inferred by piecing     together information from different sections and we have observed the behavior in other major HTTP client     implementations like curl and web browsers. Because the vulnerability requires a previously trusted     service to become compromised in order to have an impact on confidentiality we believe the exploitability     of this vulnerability is low. Additionally, many users aren't putting sensitive data in HTTP request     bodies, if this is the case then this vulnerability isn't exploitable. Both of the following conditions     must be true to be affected by this vulnerability: 1. Using urllib3 and submitting sensitive information     in the HTTP request body (such as form data or JSON) and 2. The origin service is compromised and starts     redirecting using 301, 302, or 303 to a malicious peer or the redirected-to service becomes compromised.
    This issue has been addressed in versions 1.26.18 and 2.0.7 and users are advised to update to resolve     this issue. Users unable to update should disable redirects for services that aren't expecting to respond     with redirects with `redirects=False` and disable automatic redirects with `redirects=False` and handle     301, 302, and 303 redirects manually by stripping the HTTP request body.

    CVE-2024-37891:
    urllib3 is a user-friendly HTTP client library for Python. When using urllib3's proxy support with     `ProxyManager`, the `Proxy-Authorization` header is only sent to the configured proxy, as expected.
    However, when sending HTTP requests *without* using urllib3's proxy support, it's possible to accidentally     configure the `Proxy-Authorization` header even though it won't have any effect as the request is not     using a forwarding proxy or a tunneling proxy. In those cases, urllib3 doesn't treat the `Proxy-     Authorization` HTTP header as one carrying authentication material and thus doesn't strip the header on     cross-origin redirects. Because this is a highly unlikely scenario, we believe the severity of this     vulnerability is low for almost all users. Out of an abundance of caution urllib3 will automatically strip     the `Proxy-Authorization` header during cross-origin redirects to avoid the small chance that users are     doing this on accident. Users should use urllib3's proxy support or disable automatic redirects to achieve     safe processing of the `Proxy-Authorization` header, but we still decided to strip the header by default     in order to further protect users who aren't using the correct approach. We believe the number of usages     affected by this advisory is low. It requires all of the following to be true to be exploited: 1. Setting     the `Proxy-Authorization` header without using urllib3's built-in proxy support. 2. Not disabling HTTP     redirects. 3. Either not using an HTTPS origin server or for the proxy or target origin to redirect to a     malicious origin. Users are advised to update to either version 1.26.19 or version 2.2.2. Users unable to     upgrade may use the `Proxy-Authorization` header with urllib3's `ProxyManager`, disable HTTP redirects     using `redirects=False` when sending requests, or not user the `Proxy-Authorization` header as     mitigations.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AOS installed on the remote host is prior to 7.0. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-7.0 advisory.

  - squashfs_opendir in unsquash-2.c in Squashfs-Tools 4.5 allows Directory Traversal, a different     vulnerability than CVE-2021-40153. A squashfs filesystem that has been crafted to include a symbolic link     and then contents under the same filename in a filesystem can cause unsquashfs to first create the     symbolic link pointing outside the expected directory, and then the subsequent write operation will cause     the unsquashfs process to write through the symbolic link elsewhere in the filesystem. (CVE-2021-41072)

  - An issue was discovered in libexpat before 2.6.3. nextScaffoldPart in xmlparse.c can have an integer     overflow for m_groupSize on 32-bit platforms (where UINT_MAX equals SIZE_MAX). (CVE-2024-45492)

  - Improper Handling of Exceptional Conditions, Uncontrolled Resource Consumption vulnerability in Apache     Tomcat. When processing an HTTP/2 stream, Tomcat did not handle some cases of excessive HTTP headers     correctly. This led to a miscounting of active HTTP/2 streams which in turn led to the use of an incorrect     infinite timeout which allowed connections to remain open which should have been closed. This issue     affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M20, from 10.1.0-M1 through 10.1.24, from 9.0.0-M1     through 9.0.89. The following versions were EOL at the time the CVE was created but are known to be     affected: 8.5.0 though 8.5.100. Users are recommended to upgrade to version 11.0.0-M21, 10.1.25 or 9.0.90,     which fixes the issue. (CVE-2024-34750)

  - A vulnerability was found in libndp. This flaw allows a local malicious user to cause a buffer overflow in     NetworkManager, triggered by sending a malformed IPv6 router advertisement packet. This issue occurred as     libndp was not correctly validating the route length information. (CVE-2024-5564)

  - Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of     service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of     Service (ReDoS) in package_index.py. (CVE-2022-40897)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
208377	EulerOS 2.0 SP12 : python-urllib3 (EulerOS-SA-2024-2541)	Nessus	Huawei Local Security Checks	2024/10/9	2024/10/9	medium
208980	Amazon Linux 2023 : python3-pip, python3-pip-wheel (ALAS2023-2024-730)	Nessus	Amazon Linux Local Security Checks	2024/10/14	2024/10/14	medium
214023	EulerOS 2.0 SP10 : python-urllib3 (EulerOS-SA-2025-1013)	Nessus	Huawei Local Security Checks	2025/1/13	2025/1/13	medium
235584	RockyLinux 8 : resource-agents (RLSA-2024:6311)	Nessus	Rocky Linux Local Security Checks	2025/5/7	2025/5/7	high
200807	urllib3 Python Library < 1.26.19, < 2.2.2 (CVE-2024-37891)	Nessus	Misc.	2024/6/21	2025/11/10	medium
276051	TencentOS Server 3: python3.11-urllib3 (TSSA-2024:0797)	Nessus	Tencent Local Security Checks	2025/11/20	2025/11/20	medium
276338	TencentOS Server 4: python-urllib3 (TSSA-2024:0551)	Nessus	Tencent Local Security Checks	2025/11/20	2025/11/20	medium
210402	RHEL 8 / 9 : Satellite 6.16.0 (Critical) (RHSA-2024:8906)	Nessus	Red Hat Local Security Checks	2024/11/6	2024/11/6	high
242773	NewStart CGSL MAIN 7.02 : python-urllib3 Multiple Vulnerabilities (NS-SA-2025-0157)	Nessus	NewStart CGSL Local Security Checks	2025/7/25	2025/7/25	high
207395	RHEL 8 / 9 : Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update (Moderate) (RHSA-2024:6765)	Nessus	Red Hat Local Security Checks	2024/9/18	2024/11/7	critical
242296	Oracle Database Server (July 2025 CPU)	Nessus	Databases	2025/7/18	2025/10/30	critical
213539	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-6.8.1.6)	Nessus	Misc.	2025/1/7	2025/7/22	high
239724	TencentOS Server 3: python-urllib3 (TSSA-2024:0398)	Nessus	Tencent Local Security Checks	2025/6/16	2025/11/20	medium
236045	Alibaba Cloud Linux 3 : 0182: python-urllib3 (ALINUX3-SA-2024:0182)	Nessus	Alibaba Cloud Linux Local Security Checks	2025/5/14	2025/5/14	critical
212124	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-7.0)	Nessus	Misc.	2024/12/6	2025/9/1	medium

检测

插件搜索

medium

medium

medium

high

medium

medium

medium

high

high

critical

critical

high

medium

critical

medium