The version of python3 installed on the remote host is prior to 3.7.16-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-2815 advisory.

    Directory traversal vulnerability in the (1) extract and (2) extractall functions in the tarfile module in     Python allows user-assisted remote attackers to overwrite arbitrary files via a .. (dot dot) sequence in     filenames in a TAR archive, a related issue to CVE-2001-1267. (CVE-2007-4559)

    A vulnerability has been found in the CPython `venv` module and CLI where path names provided when     creating a virtual environment were not quoted properly, allowing the creator to inject commands into     virtual environment activation scripts (ie source venv/bin/activate). This means that attacker-     controlled virtual environments are able to run commands when the virtual environment is activated.
    Virtual environments which are not created by an attacker or which aren't activated before being used (ie     ./venv/bin/python) are not affected. (CVE-2024-9287)

    The Python standard library functions `urllib.parse.urlsplit` and `urlparse` accepted domain names that     included square brackets which isn't valid according to RFC 3986. Square brackets are only meant to be     used as delimiters for specifying IPv6 and IPvFuture hosts in URLs. This could result in differential     parsing across the Python URL parser and other specification-compliant URL parsers. (CVE-2025-0938)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Amazon Linux 2 : python3 (ALAS-2025-2815)

medium Nessus Plugin ID 233711

Version 1.1