The version of python3 installed on the remote host is prior to 3.7.16-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-2815 advisory.

    Directory traversal vulnerability in the (1) extract and (2) extractall functions in the tarfile module in     Python allows user-assisted remote attackers to overwrite arbitrary files via a .. (dot dot) sequence in     filenames in a TAR archive, a related issue to CVE-2001-1267. (CVE-2007-4559)

    The Python standard library functions `urllib.parse.urlsplit` and `urlparse` accepted domain names that     included square brackets which isn't valid according to RFC 3986. Square brackets are only meant to be     used as delimiters for specifying IPv6 and IPvFuture hosts in URLs. This could result in differential     parsing across the Python URL parser and other specification-compliant URL parsers. (CVE-2025-0938)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Amazon Linux 2 : python3 (ALAS-2025-2815)

medium Nessus Plugin ID 233711

Version 1.2