遠端 Azure Linux 3.0 主機上安裝的 python3 版本比測試版本舊。因此，它會受到 CVE-2024-3219 公告中提及的一個弱點影響。

  - socket 模組針對不支援 AF_UNIX 的平台 (例如 Windows) 提供純 Python 的遞補至 socket.socketpair() 函式。此純 Python 實作使用 AF_INET 或 AF_INET6 來建立本機連線的通訊端對。系統未驗證兩個通訊端之間的連線便將兩個通訊端傳回給使用者導致伺服器通訊端容易發生來自惡意本機對等端的連線爭用。支援 AF_UNIX 的平台 (例如 Linux 和 macOS) 不會受到此弱點影響。CPython 3.5 之前的版本不會受到影響因為有弱點的 API 未包含在內。 (CVE-2024-3219)

請注意，Nessus 並未測試此問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

远程 Azure Linux 3.0 主机上安装的 python3 版本低于 测试的版本。因此，它受到 CVE-2024-3219 公告中提及的一个漏洞影响。

  - 套接字模块为不支持 AF_UNIX 的平台例如 Windows提供 socket.socketpair() 函数的 pure-Python 回退。此纯 Python 实现使用 AF_INET 或 AF_INET6 创建本地连接的套接字对。将两个套接字传回给用户之前未验证两个套接字之间的连接这使服务器套接字容易受到来自恶意本地对等机的连接争用的影响。支持 AF_UNIX 的平台例如 Linux 和 macOS 不受此漏洞的影响。由于未包含易受攻击的 APICPython 3.5 之前的版本不会受到影响。 (CVE-2024-3219)

请注意，Nessus 尚未测试此问题，而是只依据应用程序自我报告的版本号进行判断。

リモートの Azure Linux 3.0 ホストにインストールされている python3 のバージョンは、 より前の です。したがって、CVE-2024-3219 のアドバイザリに記載されている脆弱性の影響を受けます。

  - ソケットモジュールは、AF_UNIX をサポートしていない Windows などのプラットフォーム用の socket.socketpair() 関数への pure-Python フォールバックを提供します。この pure-Python 実装では、AF_INET または AF_INET6 を使用して、ローカル接続のソケットのペアを作成します。2 つのソケットをユーザーに渡す前に、2 つのソケット間の接続が検証されませんでした。これにより、サーバーソケットは、悪意のあるローカルピアからの接続競合に対して脆弱になります。LinuxやmacOSなどのAF_UNIXをサポートするプラットフォームはこの脆弱性の影響を受けません。CPython 3.5 より前のバージョンは、脆弱な API が含まれていないため影響を受けません。CVE-2024-3219

Nessus はこの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ依存していることに注意してください。

According to the versions of the python3 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    A defect was discovered in the Python ssl module where there is a memory race condition with the     ssl.SSLContext methods cert_store_stats() and get_ca_certs(). The race condition can be     triggered if the methods are called at the same time as certificates are loaded into the SSLContext,such     as during the TLS handshake with a certificate directory configured.This issue is fixed in CPython     3.10.14, 3.11.9, 3.12.3, and 3.13.0a5.(CVE-2024-0397)

    The ipaddress module contained incorrect information about whether certain IPv4 and IPv6 addresses     were designated as globally reachable or private. This affected the is_private and is_global     properties of the ipaddress.IPv4Address, ipaddress.IPv4Network, ipaddress.IPv6Address, and     ipaddress.IPv6Network classes, where values wouldnt be returned in accordance with the latest     information from the IANA Special-Purpose Address Registries.CPython 3.12.4 and 3.13.0a6 contain updated     information from these registries and thus have the intended behavior.(CVE-2024-4032)

    There is a HIGH severity vulnerability affecting the CPython 'zipfile' module affecting 'zipfile.Path'.
    Note that the more common API 'zipfile.ZipFile' class is unaffected.When iterating over names of entries     in a zip archive (for example, methods of 'zipfile.Path' like 'namelist()', 'iterdir()', etc) the process     can be put into an infinite loop with a maliciously crafted zip archive. This defect applies when reading     only metadata or extracting the contents of the zip archive. Programs that are not handling user-     controlled zip archives are not affected.(CVE-2024-8088)

    There is a MEDIUM severity vulnerability affecting CPython.The email module didnt properly quote     newlines for email headers when serializing an email message allowing for header injection when an email     is serialized.(CVE-2024-6923)

    There is a LOW severity vulnerability affecting CPython, specifically the 'http.cookies' standard library     module.When parsing cookies that contained backslashes for quoted characters in the cookie value, the     parser would use an algorithm with quadratic complexity, resulting in excess CPU resources being used     while parsing the value.(CVE-2024-7592)

    There is a MEDIUM severity vulnerability affecting CPython.Regular expressions that allowed excessive     backtracking during tarfile.TarFile header parsing are vulnerable to ReDoS via specifically-crafted tar     archives.(CVE-2024-6232)

    The  socket module provides a pure-Python fallback to the socket.socketpair() function for platforms     that dont support AF_UNIX, such as Windows. This pure-Python implementation uses AF_INET or AF_INET6 to     create a local connected pair of sockets. The connection between the two sockets was not verified before     passing the two sockets back to the user, which leaves the server socket vulnerable to a connection race     from a malicious local peer.Platforms that support AF_UNIX such as Linux and macOS are not affected by     this vulnerability. Versions prior to CPython 3.5 are not affected due to the vulnerable API not being     included.(CVE-2024-3219)

    The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special     character. The wrong portion of an RFC2822 header is identified as the value of the addr-spec. In some     applications, an attacker can bypass a protection mechanism in which application access is granted only     after verifying receipt of e-mail to a specific domain (e.g., only @company.example.com addresses may be     used for signup). This occurs in email/_parseaddr.py in recent versions of Python.(CVE-2023-27043)

Tenable has extracted the preceding description block directly from the EulerOS python3 security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the python3 packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

    There is a MEDIUM severity vulnerability affecting CPython.  The  socket module provides a pure-     Python fallback to the  socket.socketpair() function for platforms that dont support AF_UNIX,  such as     Windows. This pure-Python implementation uses AF_INET or  AF_INET6 to create a local connected pair of     sockets. The connection  between the two sockets was not verified before passing the two sockets  back to     the user, which leaves the server socket vulnerable to a  connection race from a malicious local peer.
    Platforms that support AF_UNIX such as Linux and macOS are not affected by this vulnerability. Versions     prior to CPython 3.5 are not affected due to the vulnerable API not being included.(CVE-2024-3219)

    There is a MEDIUM severity vulnerability affecting CPython.Regular expressions that allowed excessive     backtracking during tarfile.TarFile header parsing are vulnerable to ReDoS via specifically-crafted tar     archives.(CVE-2024-6232)

    There is a HIGH severity vulnerability affecting the CPython 'zipfile' module affecting 'zipfile.Path'.
    Note that the more common API 'zipfile.ZipFile' class is unaffected. When iterating over names of entries     in a zip archive (for example, methods of 'zipfile.Path' like 'namelist()', 'iterdir()', etc) the process     can be put into an infinite loop with a maliciously crafted zip archive. This defect applies when reading     only metadata or extracting the contents of the zip archive. Programs that are not handling user-     controlled zip archives are not affected.(CVE-2024-8088)

    There is a MEDIUM severity vulnerability affecting CPython.  The  email module didnt properly quote     newlines for email headers when  serializing an email message allowing for header injection when an email     is serialized.(CVE-2024-6923)

    There is a LOW severity vulnerability affecting CPython, specifically the 'http.cookies' standard library     module.   When parsing cookies that contained backslashes for quoted characters in the cookie value, the     parser would use an algorithm with quadratic complexity, resulting in excess CPU resources being used     while parsing the value.(CVE-2024-7592)

    A defect was discovered in the Python ssl module where there is a memory race condition with the     ssl.SSLContext methods cert_store_stats() and get_ca_certs(). The race condition can be     triggered if the methods are called at the same time as certificates are loaded into the SSLContext, such     as during the TLS handshake with a certificate directory configured. This issue is fixed in CPython     3.10.14, 3.11.9, 3.12.3, and 3.13.0a5.(CVE-2024-0397)

    The ipaddress module contained incorrect information about whether certain IPv4 and IPv6 addresses     were designated as globally reachable or private. This affected the is_private and is_global     properties of the ipaddress.IPv4Address, ipaddress.IPv4Network, ipaddress.IPv6Address, and     ipaddress.IPv6Network classes, where values wouldnt be returned in accordance with the latest     information from the IANA Special-Purpose Address Registries.  CPython 3.12.4 and 3.13.0a6 contain updated     information from these registries and thus have the intended behavior.(CVE-2024-4032)

    The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special     character. The wrong portion of an RFC2822 header is identified as the value of the addr-spec. In some     applications, an attacker can bypass a protection mechanism in which application access is granted only     after verifying receipt of e-mail to a specific domain (e.g., only @company.example.com addresses may be     used for signup). This occurs in email/_parseaddr.py in recent versions of Python.(CVE-2023-27043)

    A vulnerability has been found in the CPython `venv` module and CLI where path names provided when     creating a virtual environment were not quoted properly, allowing the creator to inject commands into     virtual environment 'activation' scripts (ie 'source venv/bin/activate'). This means that attacker-     controlled virtual environments are able to run commands when the virtual environment is activated.
    Virtual environments which are not created by an attacker or which aren't activated before being used (ie     './venv/bin/python') are not affected.(CVE-2024-9287)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization python3 security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of python3 installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-3219 advisory.

  - The socket module provides a pure-Python fallback to the socket.socketpair() function for platforms that     don't support AF_UNIX, such as Windows. This pure-Python implementation uses AF_INET or AF_INET6 to create     a local connected pair of sockets. The connection between the two sockets was not verified before passing     the two sockets back to the user, which leaves the server socket vulnerable to a connection race from a     malicious local peer. Platforms that support AF_UNIX such as Linux and macOS are not affected by this     vulnerability. Versions prior to CPython 3.5 are not affected due to the vulnerable API not being     included. (CVE-2024-3219)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the python3 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    There is a MEDIUM severity vulnerability affecting CPython.  The  socket module provides a pure-     Python fallback to the  socket.socketpair() function for platforms that dont support AF_UNIX,  such as     Windows. This pure-Python implementation uses AF_INET or  AF_INET6 to create a local connected pair of     sockets. The connection  between the two sockets was not verified before passing the two sockets  back to     the user, which leaves the server socket vulnerable to a  connection race from a malicious local peer.
    Platforms that support AF_UNIX such as Linux and macOS are not affected by this vulnerability. Versions     prior to CPython 3.5 are not affected due to the vulnerable API not being included.(CVE-2024-3219)

    There is a MEDIUM severity vulnerability affecting CPython.Regular expressions that allowed excessive     backtracking during tarfile.TarFile header parsing are vulnerable to ReDoS via specifically-crafted tar     archives.(CVE-2024-6232)

    There is a HIGH severity vulnerability affecting the CPython 'zipfile' module affecting 'zipfile.Path'.
    Note that the more common API 'zipfile.ZipFile' class is unaffected. When iterating over names of entries     in a zip archive (for example, methods of 'zipfile.Path' like 'namelist()', 'iterdir()', etc) the process     can be put into an infinite loop with a maliciously crafted zip archive. This defect applies when reading     only metadata or extracting the contents of the zip archive. Programs that are not handling user-     controlled zip archives are not affected.(CVE-2024-8088)

    There is a MEDIUM severity vulnerability affecting CPython.  The  email module didnt properly quote     newlines for email headers when  serializing an email message allowing for header injection when an email     is serialized.(CVE-2024-6923)

    There is a LOW severity vulnerability affecting CPython, specifically the 'http.cookies' standard library     module.   When parsing cookies that contained backslashes for quoted characters in the cookie value, the     parser would use an algorithm with quadratic complexity, resulting in excess CPU resources being used     while parsing the value.(CVE-2024-7592)

    A defect was discovered in the Python ssl module where there is a memory race condition with the     ssl.SSLContext methods cert_store_stats() and get_ca_certs(). The race condition can be     triggered if the methods are called at the same time as certificates are loaded into the SSLContext, such     as during the TLS handshake with a certificate directory configured. This issue is fixed in CPython     3.10.14, 3.11.9, 3.12.3, and 3.13.0a5.(CVE-2024-0397)

    The ipaddress module contained incorrect information about whether certain IPv4 and IPv6 addresses     were designated as globally reachable or private. This affected the is_private and is_global     properties of the ipaddress.IPv4Address, ipaddress.IPv4Network, ipaddress.IPv6Address, and     ipaddress.IPv6Network classes, where values wouldnt be returned in accordance with the latest     information from the IANA Special-Purpose Address Registries.  CPython 3.12.4 and 3.13.0a6 contain updated     information from these registries and thus have the intended behavior.(CVE-2024-4032)

    The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special     character. The wrong portion of an RFC2822 header is identified as the value of the addr-spec. In some     applications, an attacker can bypass a protection mechanism in which application access is granted only     after verifying receipt of e-mail to a specific domain (e.g., only @company.example.com addresses may be     used for signup). This occurs in email/_parseaddr.py in recent versions of Python.(CVE-2023-27043)

Tenable has extracted the preceding description block directly from the EulerOS python3 security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
295062	Azure Linux 3.0 安全性更新python3 (CVE-2024-3219)	Nessus	Azure Linux Local Security Checks	2026/1/22	2026/1/22	medium
295062	Azure Linux 3.0 安全更新python3 (CVE-2024-3219)	Nessus	Azure Linux Local Security Checks	2026/1/22	2026/1/22	medium
295062	Azure Linux 3.0 セキュリティ更新python3CVE-2024-3219]	Nessus	Azure Linux Local Security Checks	2026/1/22	2026/1/22	medium
212647	EulerOS 2.0 SP11 : python3 (EulerOS-SA-2024-2985)	Nessus	Huawei Local Security Checks	2024/12/12	2024/12/12	critical
236913	EulerOS Virtualization 2.12.1 : python3 (EulerOS-SA-2025-1556)	Nessus	Huawei Local Security Checks	2025/5/17	2025/5/17	critical
295062	Azure Linux 3.0 Security Update: python3 (CVE-2024-3219)	Nessus	Azure Linux Local Security Checks	2026/1/22	2026/1/22	medium
212627	EulerOS 2.0 SP12 : python3 (EulerOS-SA-2024-2942)	Nessus	Huawei Local Security Checks	2024/12/12	2024/12/12	critical
212649	EulerOS 2.0 SP12 : python3 (EulerOS-SA-2024-2957)	Nessus	Huawei Local Security Checks	2024/12/12	2024/12/12	critical
236924	EulerOS Virtualization 2.12.0 : python3 (EulerOS-SA-2025-1572)	Nessus	Huawei Local Security Checks	2025/5/17	2025/5/17	critical
212637	EulerOS 2.0 SP11 : python3 (EulerOS-SA-2024-2971)	Nessus	Huawei Local Security Checks	2024/12/12	2024/12/12	critical

检测

插件搜索

medium

medium

medium

critical

critical

medium

critical

critical

critical

critical