The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2020:1605 advisory.

  - The Requests package before 2.20.0 for Python sends an HTTP Authorization header to an http URI upon     receiving a same-hostname https-to-http redirect, which makes it easier for remote attackers to discover     credentials by sniffing the network. (CVE-2018-18074)

  - urllib3 before version 1.23 does not remove the Authorization HTTP header when following a cross-origin     redirect (i.e., a redirect that differs in host, port, or scheme). This can allow for credentials in the     Authorization header to be exposed to unintended hosts or transmitted in cleartext. (CVE-2018-20060)

  - http.cookiejar.DefaultPolicy.domain_return_ok in Lib/http/cookiejar.py in Python before 3.7.3 does not     correctly validate the domain: it can be tricked into sending existing cookies to the wrong server. An     attacker may abuse this flaw by using a server with a hostname that has another valid hostname as a suffix     (e.g., pythonicexample.com to steal cookies for example.com). When a program uses     http.cookiejar.DefaultPolicy and tries to do an HTTP connection to an attacker-controlled server, existing     cookies can be leaked to the attacker. This affects 2.x through 2.7.16, 3.x before 3.4.10, 3.5.x before     3.5.7, 3.6.x before 3.6.9, and 3.7.x before 3.7.3. (CVE-2018-20852)

  - In the urllib3 library through 1.24.1 for Python, CRLF injection is possible if the attacker controls the     request parameter. (CVE-2019-11236)

  - The urllib3 library before 1.24.2 for Python mishandles certain cases where the desired set of CA     certificates is different from the OS store of CA certificates, which results in SSL connections     succeeding in situations where a verification failure is the correct outcome. This is related to use of     the ssl_context, ca_certs, or ca_certs_dir argument. (CVE-2019-11324)

  - An issue was discovered in Python through 2.7.16, 3.x through 3.5.7, 3.6.x through 3.6.9, and 3.7.x     through 3.7.4. The email module wrongly parses email addresses that contain multiple @ characters. An     application that uses the email module and implements some kind of checks on the From/To headers of a     message could be tricked into accepting an email address that should be denied. An attack may be the same     as in CVE-2019-11340; however, this CVE applies to Python more generally. (CVE-2019-16056)

  - The documentation XML-RPC server in Python through 2.7.16, 3.x through 3.6.9, and 3.7.x through 3.7.4 has     XSS via the server_title field. This occurs in Lib/DocXMLRPCServer.py in Python 2.x, and in     Lib/xmlrpc/server.py in Python 3.x. If set_server_title is called with untrusted input, arbitrary     JavaScript can be delivered to clients that visit the http URL for this server. (CVE-2019-16935)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-1916 advisory.

    [9.0.3-16]
    - Add four new patches for CVEs in bundled urllib3 and requests     CVE-2018-20060, CVE-2019-11236, CVE-2019-11324, CVE-2018-18074     Resolves: rhbz#1649153     Resolves: rhbz#1700824     Resolves: rhbz#1702473     Resolves: rhbz#1643829

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3610 advisory.

  - urllib3 before version 1.23 does not remove the Authorization HTTP header when following a cross-origin     redirect (i.e., a redirect that differs in host, port, or scheme). This can allow for credentials in the     Authorization header to be exposed to unintended hosts or transmitted in cleartext. (CVE-2018-20060)

  - In the urllib3 library through 1.24.1 for Python, CRLF injection is possible if the attacker controls the     request parameter. (CVE-2019-11236)

  - The urllib3 library before 1.24.2 for Python mishandles certain cases where the desired set of CA     certificates is different from the OS store of CA certificates, which results in SSL connections     succeeding in situations where a verification failure is the correct outcome. This is related to use of     the ssl_context, ca_certs, or ca_certs_dir argument. (CVE-2019-11324)

  - An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3.
    CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument     to urllib.request.urlopen with \r\n (specifically in the query string after a ? character) followed by an     HTTP header or a Redis command. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10,     v3.5.10rc1, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12,     v3.6.9, v3.6.9rc1; v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1,     v3.7.8, v3.7.8rc1, v3.7.9. (CVE-2019-9740)

  - http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5     allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR     and LF control characters in the first argument of HTTPConnection.request. (CVE-2020-26116)

  - urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as     demonstrated by inserting CR and LF control characters in the first argument of putrequest(). NOTE: this     is similar to CVE-2020-26116. (CVE-2020-26137)

  - urllib3 is a user-friendly HTTP client library for Python. urllib3 doesn't treat the `Cookie` HTTP header     special or provide any helpers for managing cookies over HTTP, that is the responsibility of the user.
    However, it is possible for a user to specify a `Cookie` header and unknowingly leak information via HTTP     redirects to a different origin if that user doesn't disable redirects explicitly. This issue has been     patched in urllib3 version 1.26.17 or 2.0.5. (CVE-2023-43804)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2020-0851 advisory.

    [15.1.0-4]
    - Bump     Resolves: rhbz#1649153     Resolves: rhbz#1700824     Resolves: rhbz#1643829

    [15.1.0-3]
    - Add three new patches for CVEs in bundled urllib3 and requests     CVE-2018-20060, CVE-2019-11236, CVE-2018-18074     Resolves: rhbz#1649153     Resolves: rhbz#1700824     Resolves: rhbz#1643829

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

- Fix an issue similar to CVE-2018-20060 where the     authorization header was removed only when the case     matched. 

  - Fix an issue where the system CA bundle was loaded even     when an alternate bundle was explicitly specified     (https://www.openwall.com/lists/oss-security/2019/04/17/     3)

Full changelog at:
https://github.com/urllib3/urllib3/blob/1.24.2/CHANGES.rst

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

urllib3 before version 1.23 does not remove the Authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs in host, port, or scheme). This can allow for credentials in the Authorization header to be exposed to unintended hosts or transmitted in cleartext. (CVE-2018-20060)

In the urllib3 library through 1.24.1 for Python, CRLF injection is possible if the attacker controls the request parameter.
(CVE-2019-11236)

A credentials-exposure flaw was found in python-requests, where if a request with authentication is redirected (302) from an HTTPS endpoint to an HTTP endpoint on the same host, the Authorization header is not stripped and the credentials can be read in plain text. A man-in-the-middle attacker could exploit this flaw to obtain a user's valid credentials. (CVE-2018-18074)

ID	Name	Product	Family	Published	Updated	Severity
164612	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.17.1)	Nessus	Misc.	9/1/2022	11/15/2024	critical
164573	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.16)	Nessus	Misc.	9/1/2022	11/16/2024	critical
184876	Rocky Linux 8 : python27:2.7 (RLSA-2020:1605)	Nessus	Rocky Linux Local Security Checks	11/7/2023	11/7/2023	critical
180967	Oracle Linux 8 : python-pip (ELSA-2020-1916)	Nessus	Oracle Linux Local Security Checks	9/7/2023	11/1/2024	critical
182762	Debian DLA-3610-1 : python-urllib3 - LTS security update	Nessus	Debian Local Security Checks	10/8/2023	10/15/2023	critical
134689	Oracle Linux 7 : python-virtualenv (ELSA-2020-0851)	Nessus	Oracle Linux Local Security Checks	3/19/2020	11/1/2024	critical
124372	Fedora 28 : python-urllib3 (2019-8560719e80)	Nessus	Fedora Local Security Checks	4/30/2019	5/30/2024	critical
124501	Fedora 30 : python-urllib3 (2019-6afaa38e7b)	Nessus	Fedora Local Security Checks	5/2/2019	5/30/2024	critical
135931	Amazon Linux 2 : python-virtualenv (ALAS-2020-1413)	Nessus	Amazon Linux Local Security Checks	4/24/2020	3/14/2024	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical

critical

critical

critical

critical