The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-4160 advisory.

    - Security fix for CVE-2021-28957     Resolves: rhbz#1941534
    - Fixes CVE-2020-27783 and another vulnerability in the HTML Cleaner
    - Fix for CVE-2021-33503 Catastrophic backtracking in URL authority parser     Resolves: rhbz#1968074
    - Fix CVE-2021-29921: Improper input validation of octal strings in the ipaddress module     Resolves: rhbz#1957458
    - Security fix for CVE-2021-3426: information disclosure via pydoc     Resolves: rhbz#1935913

    python3x-pip
    - Fix for CVE-2021-33503 Catastrophic backtracking in URL authority parser     Resolves: rhbz#1968074
    - Fix for CVE-2021-3572 - pip incorrectly handled unicode separators in git references     Resolves: rhbz#1962856

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Oracle Linux 8 : python39:3.9 / and / python39-devel:3.9 (ELSA-2021-4160)

critical Nessus Plugin ID 155967

Version 1.6