The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2025:0803 advisory.

    Package updates are available for TencentOS Server 2 that fix the following vulnerabilities:

    CVE-2025-8194:
    There is a defect in the CPython tarfile module affecting the TarFile extraction and entry     enumeration APIs. The tar implementation would process tar archives with negative offsets without error,     resulting in an infinite loop and deadlock during the parsing of maliciously crafted tar archives.

    This vulnerability can be mitigated by including the following patch after importing the tarfile     module: https://gist.github.com/sethmlarson/1716ac5b82b73dbcbf23ad2eff8b33e1

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the python3 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    Allows the extraction filter to be ignored, allowing symlink targets to point outside the destination     directory, and the modification of some file metadata.


    You are affected by this vulnerability if using the tarfilemodule to extract untrusted tar archives     using TarFile.extractall()or TarFile.extract()using the filter=parameter with a value of 'data'or     'tar'. See the tarfile  extraction filters documentation     https://docs.python.org/3/library/tarfile.html#tarfile-extraction-filter for more information.

    Note that for Python 3.14 or later the default value of filter=changed from 'no filtering' to `'data',     so if you are relying on this new default behavior then your usage is also affected.

    Note that none of these vulnerabilities significantly affect the installation of source distributions     which are tar archives as source distributions already allow arbitrary code execution during the build     process. However when evaluating source distributions it's important to avoid installing source     distributions with suspicious links.(CVE-2025-4330)

    Allows the extraction filter to be ignored, allowing symlink targets to point outside the destination     directory, and the modification of some file metadata.


    You are affected by this vulnerability if using the tarfilemodule to extract untrusted tar archives     using TarFile.extractall()or TarFile.extract()using the filter=parameter with a value of 'data'or     'tar'. See the tarfile  extraction filters documentation     https://docs.python.org/3/library/tarfile.html#tarfile-extraction-filter for more information.

    Note that for Python 3.14 or later the default value of filter=changed from 'no filtering' to `'data',     so if you are relying on this new default behavior then your usage is also affected.

    Note that none of these vulnerabilities significantly affect the installation of source distributions     which are tar archives as source distributions already allow arbitrary code execution during the build     process. However when evaluating source distributions it's important to avoid installing source     distributions with suspicious links.(CVE-2025-4138)

    There is a defect in the CPython tarfile module affecting the TarFile extraction and entry     enumeration APIs. The tar implementation would process tar archives with negative offsets without error,     resulting in an infinite loop and deadlock during the parsing of maliciously crafted tar archives.

    This vulnerability can be mitigated by including the following patch after importing the tarfile     module: https://gist.github.com/sethmlarson/1716ac5b82b73dbcbf23ad2eff8b33e1(CVE-2025-8194)

    Allows arbitrary filesystem writes outside the extraction directory during extraction with filter='data'.
    You are affected by this vulnerability if using the tarfilemodule to extract untrusted tar archives     using TarFile.extractall()or TarFile.extract()using the filter=parameter with a value of 'data'or     'tar'. See the tarfile extraction filters documentation     https://docs.python.org/3/library/tarfile.html#tarfile-extraction-filter for more information. Note that     for Python 3.14 or later the default value of filter=changed from 'no filtering' to `'data', so if you     are relying on this new default behavior then your usage is also affected. Note that none of these     vulnerabilities significantly affect the installation of source distributions which are tar archives as     source distributions already allow arbitrary code execution during the build process. However when     evaluating source distributions it's important to avoid installing source distributions with suspicious     links.(CVE-2025-4517)

    When using a TarFile.errorlevel = 0and extracting with a filter the documented behavior is that any     filtered members would be skipped and not extracted. However the actual behavior of TarFile.errorlevel =     0in affected versions is that the member would still be extracted and not skipped.(CVE-2025-4435)

Tenable has extracted the preceding description block directly from the EulerOS python3 security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the python3 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    During an address list folding when a separating comma ends up on a folded line and that line is to be     unicode-encoded then the separator itself is also unicode-encoded. Expected behavior is that the     separating comma remains a plan comma. This can result in the address header being misinterpreted by some     mail servers.(CVE-2025-1795)

    There is an issue in CPython when using `bytes.decode('unicode_escape', error='ignore|replace')`. If you     are not using the 'unicode_escape' encoding or an error handler your usage is not affected. To work-around     this issue you may stop using the error= handler and instead wrap the bytes.decode() call in a try-except     catching the DecodeError.(CVE-2025-4516)

    The html.parser.HTMLParser class had worse-case quadratic complexity when processing certain crafted     malformed inputs potentially leading to amplified denial-of-service.(CVE-2025-6069)

    There is a defect in the CPython tarfile module affecting the TarFile extraction and entry     enumeration APIs. The tar implementation would process tar archives with negative offsets without error,     resulting in an infinite loop and deadlock during the parsing of maliciously crafted tar archives.

    This vulnerability can be mitigated by including the following patch after importing the tarfile     module: https://gist.github.com/sethmlarson/1716ac5b82b73dbcbf23ad2eff8b33e1(CVE-2025-8194)

Tenable has extracted the preceding description block directly from the EulerOS python3 security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:02717-1 advisory.

    - CVE-2025-8194: Fixed denial of service caused by tar archives with negative offsets (bsc#1247249).
    - CVE-2025-6069: Avoid worst case quadratic complexity when processing certain crafted malformed inputs     with HTMLParser (bsc#1244705).
    - CVE-2025-4435: Fixed Tarfile extracting filtered members when errorlevel=0 (bsc#1244061).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1135 advisory.

    There is a defect in the CPython tarfile module affecting the TarFile extraction and entry enumeration     APIs. The tar implementation would process tar archives with negative offsets without error, resulting in     an infinite loop and deadlock during the parsing of maliciously crafted tar archives.

    This vulnerability can be mitigated by including the following patch after importing the tarfile module:
    https://gist.github.com/sethmlarson/1716ac5b82b73dbcbf23ad2eff8b33e1 (CVE-2025-8194)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:15007 advisory.

    Python is an interpreted, interactive, object-oriented programming language, which includes modules,     classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to     many system calls and libraries, as well as to various windowing systems.

    Security Fix(es):

    * cpython: Cpython infinite loop when parsing a tarfile (CVE-2025-8194)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2025:14546 advisory.

    * cpython: Cpython infinite loop when parsing a tarfile (CVE-2025-8194)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:16012 advisory.

    Python is an interpreted, interactive, object-oriented programming language, which includes modules,     classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to     many system calls and libraries, as well as to various windowing systems.

    Security Fix(es):

    * cpython: Cpython infinite loop when parsing a tarfile (CVE-2025-8194)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:16118 advisory.

    Python is an interpreted, interactive, object-oriented programming language, which includes modules,     classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to     many system calls and libraries, as well as to various windowing systems.

    Security Fix(es):

    * cpython: Cpython infinite loop when parsing a tarfile (CVE-2025-8194)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2025:15010 advisory.

    * cpython: Cpython infinite loop when parsing a tarfile (CVE-2025-8194)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2025:14560 advisory.

    * cpython: Cpython infinite loop when parsing a tarfile (CVE-2025-8194)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2025-10802:08 advisory.

    * cpython: Cpython infinite loop when parsing a tarfile (CVE-2025-8194)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2025-10803:10 advisory.

    * cpython: Cpython infinite loop when parsing a tarfile (CVE-2025-8194)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 7 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2025-11503:37 advisory.

    * CVE-2025-8194: fix infinite loop and deadlock in TarFile extraction and     entry enumeration APIs     CVE(s):
    CVE-2025-8194     There is a defect in the CPython tarfile module affecting the TarFile extraction and entry enumeration     APIs. The tar implementation would process tar archives with negative offsets without error, resulting in     an infinite loop and deadlock during the parsing of maliciously crafted tar archives. This vulnerability     can be mitigated by including the following patch after importing the tarfile module:
    https://gist.github.com/sethmlarson/1716ac5b82b73dbcbf23ad2eff8b33e1

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the python3 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    There is a defect in the CPython 'tarfile' module affecting the 'TarFile' extraction and entry enumeration     APIs. The tar implementation would process tar archives with negative offsets without error, resulting in     an infinite loop and deadlock during the parsing of maliciously crafted tar archives. This vulnerability     can be mitigated by including the following patch after importing the 'tarfile' module:
    https://gist.github.com/sethmlarson/1716ac5b82b73dbcbf23ad2eff8b33e1(CVE-2025-8194)

    During an address list folding when a separating comma ends up on a folded line and that line is to be     unicode-encoded then the separator itself is also unicode-encoded. Expected behavior is that the     separating comma remains a plan comma. This can result in the address header being misinterpreted by some     mail servers.(CVE-2025-1795)

    The html.parser.HTMLParser class had worse-case quadratic complexity when processing certain crafted     malformed inputs potentially leading to amplified denial-of-service.(CVE-2025-6069)

    There is an issue in CPython when using `bytes.decode('unicode_escape', error='ignore|replace')`. If you     are not using the 'unicode_escape' encoding or an error handler your usage is not affected. To work-around     this issue you may stop using the error= handler and instead wrap the bytes.decode() call in a try-except     catching the DecodeError.(CVE-2025-4516)

Tenable has extracted the preceding description block directly from the EulerOS python3 security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
271113	TencentOS Server 2: python3 (TSSA-2025:0803)	Nessus	Tencent Local Security Checks	2025/10/22	2026/4/30	high
274888	EulerOS 2.0 SP12 : python3 (EulerOS-SA-2025-2339)	Nessus	Huawei Local Security Checks	2025/11/12	2026/4/30	critical
278476	EulerOS 2.0 SP11 : python3 (EulerOS-SA-2025-2469)	Nessus	Huawei Local Security Checks	2025/12/11	2026/4/30	low
244839	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : python311 (SUSE-SU-2025:02717-1)	Nessus	SuSE Local Security Checks	2025/8/7	2026/4/30	high
251382	Amazon Linux 2023 : python3.12, python3.12-devel, python3.12-idle (ALAS2023-2025-1135)	Nessus	Amazon Linux Local Security Checks	2025/8/18	2026/4/30	high
260458	RHEL 9 : python3.12 (RHSA-2025:15007)	Nessus	Red Hat Local Security Checks	2025/9/2	2026/4/30	high
261227	AlmaLinux 8 : python3.12 (ALSA-2025:14546)	Nessus	Alma Linux Local Security Checks	2025/9/4	2026/4/30	high
265320	RHEL 9 : python3.11 (RHSA-2025:16012)	Nessus	Red Hat Local Security Checks	2025/9/17	2026/4/30	high
265340	RHEL 8 : python39:3.9 (RHSA-2025:16118)	Nessus	Red Hat Local Security Checks	2025/9/17	2026/4/30	high
266066	AlmaLinux 9 : python3.11 (ALSA-2025:15010)	Nessus	Alma Linux Local Security Checks	2025/9/29	2026/4/30	high
266138	AlmaLinux 8 : python3 (ALSA-2025:14560)	Nessus	Alma Linux Local Security Checks	2025/9/29	2026/4/30	high
282717	MiracleLinux 8 : python3.11-3.11.13-2.el8_10 (AXSA:2025-10802:08)	Nessus	Miracle Linux Local Security Checks	2026/1/13	2026/4/30	high
282963	MiracleLinux 8 : python3.12-3.12.11-2.el8_10 (AXSA:2025-10803:10)	Nessus	Miracle Linux Local Security Checks	2026/1/13	2026/4/30	high
283446	MiracleLinux 7 : python-2.7.5-94.0.5.el7.AXS7 (AXSA:2025-11503:37)	Nessus	Miracle Linux Local Security Checks	2026/1/13	2026/4/30	high
284733	EulerOS 2.0 SP10 : python3 (EulerOS-SA-2026-1057)	Nessus	Huawei Local Security Checks	2026/1/15	2026/4/30	low
284775	EulerOS 2.0 SP10 : python3 (EulerOS-SA-2026-1036)	Nessus	Huawei Local Security Checks	2026/1/15	2026/4/30	low

检测

插件搜索

high

critical

low

high

high

high

high

high

high

high

high

high

high

high

low

low