The remote Fedora 36 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2022-2173709172 advisory.

    Backport fix for CVE-2021-28861

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-ddde191e04 advisory.

    Automatic update for pypy3.10-7.3.12-1.3.10.fc39.

    ##### **Changelog**

    ```
    * Wed Jul 26 2023 Miro Hronok <mhroncok@redhat.com> - 7.3.12-1.3.10
    - Initial PyPy 3.10 package
    * Wed Jul 26 2023 Miro Hronok <mhroncok@redhat.com> - 7.3.12-1.3.9
    - Update to 7.3.12
    - Fixes: rhbz#2203423
    * Fri Jul 21 2023 Fedora Release Engineering <releng@fedoraproject.org> - 7.3.11-5.3.9
    - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
    * Mon May 29 2023 Charalampos Stratakis <cstratak@redhat.com> - 7.3.11-4.3.9
    - Security fix for CVE-2023-24329     Resolves: rhbz#2174020
    * Fri Feb 17 2023 Miro Hronok <mhroncok@redhat.com> - 7.3.11-3.3.9
    - On Fedora 38+, obsolete the pypy3.8 package which is no longer available
    * Fri Jan 20 2023 Fedora Release Engineering <releng@fedoraproject.org> - 7.3.11-2.3.9
    - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
    * Fri Dec 30 2022 Miro Hronok <mhroncok@redhat.com> - 7.3.11-1.3.9
    - Update to 7.3.11
    - Fixes: rhbz#2147520
    * Fri Dec  2 2022 Miro Hronok <mhroncok@redhat.com> - 7.3.9-5.3.9
    - On Fedora 37+, obsolete the pypy3.7 package which is no longer available
    * Mon Oct 10 2022 Lumr Balhar <lbalhar@redhat.com> - 7.3.9-4.3.9
    - Backport fix for CVE-2021-28861     Resolves: rhbz#2120789
    * Fri Jul 22 2022 Fedora Release Engineering <releng@fedoraproject.org> - 7.3.9-3.3.9
    - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
    * Tue Jun 28 2022 Charalampos Stratakis <cstratak@redhat.com> - 7.3.9-2.3.9
    - Security fix for CVE-2015-20107
    - Fixes: rhbz#2075390
    * Wed Mar 30 2022 Miro Hronok <mhroncok@redhat.com> - 7.3.9-1.3.9
    - Update to 7.3.9
    - Fixes: rhbz#2069873
    * Tue Mar  1 2022 Miro Hronok <mhroncok@redhat.com> - 7.3.8-1.3.9
    - Include the Python version in Release to workaround debuginfo conflicts       and make same builds of different PyPy sort in a predictable way (e.g. wrt Obsoletes)
    - Namespace the debugsources to fix installation conflict with other PyPys
    - Fixes: rhbz#2053880
    - This is now the main PyPy 3 on Fedora 36+
    - Fixes: rhbz#2059670
    * Tue Feb 22 2022 Miro Hronok <mhroncok@redhat.com> - 7.3.8-1
    - Update to 7.3.8 final
    * Fri Feb 11 2022 Miro Hronok <mhroncok@redhat.com> - 7.3.8~rc2-1
    - Update to 7.3.8rc2
    * Wed Jan 26 2022 Miro Hronok <mhroncok@redhat.com> - 7.3.8~rc1-1
    - Update to 7.3.8rc1
    - Move to a CPython-like installation layout
    - Stop requiring pypy3.9 from pypy3.9-libs
    - Split tests into pypy3.9-test
    * Fri Jan 21 2022 Fedora Release Engineering <releng@fedoraproject.org> - 7.3.7-3
    - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
    * Sat Jan  8 2022 Miro Hronok <mhroncok@redhat.com> - 7.3.7-2
    - Rebuilt for https://fedoraproject.org/wiki/Changes/LIBFFI34
    * Thu Nov 11 2021 Miro Hronok <mhroncok@redhat.com> - 7.3.7-1
    - Initial pypy3.8 package
    - Supplement tox
    * Tue Oct 26 2021 Tom Hrniar <thrnciar@redhat.com> - 7.3.6-1
    - Update to 7.3.6
    - Remove windows executable binaries
    - Fixes: rhbz#2003682
    * Mon Sep 20 2021 Miro Hronok <mhroncok@redhat.com> - 7.3.5-2
    - Explicitly buildrequire OpenSSL 1.1, as Python 3.7 is not compatible with OpenSSL 3.0
    * Mon Aug 16 2021 Miro Hronok <mhroncok@redhat.com> - 7.3.5-1
    - Update to 7.3.5
    - Fixes: rhbz#1992600
    * Mon Aug  9 2021 Tomas Hrnciar <thrnciar@redhat.com> - 7.3.4-4
    - Rename pypy3 to pypy3.7
    - pypy-stackless was removed

    ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 36 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-d1682fef04 advisory.

    Update to python-3.10.8.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 37 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2022-20116fb6aa advisory.

    Backport fix for CVE-2021-28861

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2022-2e93acb55d advisory.

    Automatic update for python3.6-3.6.15-12.fc38.

    ##### **Changelog**

    ```
    * Wed Sep 14 2022 Lumr Balhar <lbalhar@redhat.com> - 3.6.15-12
    - Fix for CVE-2021-28861     Resolves: rhbz#2120785

    ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:3511-1 advisory.

  - ** DISPUTED ** Python 3.x through 3.10 has an open redirection vulnerability in lib/http/server.py due to     no protection against multiple (/) at the beginning of URI path which may leads to information disclosure.
    NOTE: this is disputed by a third party because the http.server.html documentation page states Warning:
    http.server is not recommended for production. It only implements basic security checks. (CVE-2021-28861)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:3483-1 advisory.

  - ** DISPUTED ** Python 3.x through 3.10 has an open redirection vulnerability in lib/http/server.py due to     no protection against multiple (/) at the beginning of URI path which may leads to information disclosure.
    NOTE: this is disputed by a third party because the http.server.html documentation page states Warning:
    http.server is not recommended for production. It only implements basic security checks. (CVE-2021-28861)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:3511-2 advisory.

  - ** DISPUTED ** Python 3.x through 3.10 has an open redirection vulnerability in lib/http/server.py due to     no protection against multiple (/) at the beginning of URI path which may leads to information disclosure.
    NOTE: this is disputed by a third party because the http.server.html documentation page states Warning:
    http.server is not recommended for production. It only implements basic security checks. (CVE-2021-28861)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:0833 advisory.

    Python is an interpreted, interactive, object-oriented programming language, which includes modules,     classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to     many system calls and libraries, as well as to various windowing systems.

    Security Fix(es):

    * python: int() type in PyLong_FromString() does not limit amount of digits converting text to int leading     to DoS (CVE-2020-10735)

    * python: open redirection vulnerability in lib/http/server.py may lead to information disclosure     (CVE-2021-28861)

    * Python: CPU denial of service via inefficient IDNA decoder (CVE-2022-45061)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2023:0833 advisory.

  - A flaw was found in python. In algorithms with quadratic time complexity using non-binary bases, when     using int(text), a system could take 50ms to parse an int string with 100,000 digits and 5s for     1,000,000 digits (float, decimal, int.from_bytes(), and int() for binary bases 2, 4, 8, 16, and 32 are not     affected). The highest threat from this vulnerability is to system availability. (CVE-2020-10735)

  - ** DISPUTED ** Python 3.x through 3.10 has an open redirection vulnerability in lib/http/server.py due to     no protection against multiple (/) at the beginning of URI path which may leads to information disclosure.
    NOTE: this is disputed by a third party because the http.server.html documentation page states Warning:
    http.server is not recommended for production. It only implements basic security checks. (CVE-2021-28861)

  - An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path     when processing some inputs to the IDNA (RFC 3490) decoder, such that a crafted, unreasonably long name     being presented to the decoder could lead to a CPU denial of service. Hostnames are often supplied by     remote servers that could be controlled by a malicious actor; in such a scenario, they could trigger     excessive CPU consumption on the client attempting to make use of an attacker-supplied supposed hostname.
    For example, the attack payload could be placed in the Location header of an HTTP response with status     code 302. A fix is planned in 3.11.1, 3.10.9, 3.9.16, 3.8.16, and 3.7.16. (CVE-2022-45061)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-2764 advisory.

  - An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path     when processing some inputs to the IDNA (RFC 3490) decoder, such that a crafted, unreasonably long name     being presented to the decoder could lead to a CPU denial of service. Hostnames are often supplied by     remote servers that could be controlled by a malicious actor; in such a scenario, they could trigger     excessive CPU consumption on the client attempting to make use of an attacker-supplied supposed hostname.
    For example, the attack payload could be placed in the Location header of an HTTP response with status     code 302. A fix is planned in 3.11.1, 3.10.9, 3.9.16, 3.8.16, and 3.7.16. (CVE-2022-45061)

  - A flaw was found in python. In algorithms with quadratic time complexity using non-binary bases, when     using int(text), a system could take 50ms to parse an int string with 100,000 digits and 5s for     1,000,000 digits (float, decimal, int.from_bytes(), and int() for binary bases 2, 4, 8, 16, and 32 are not     affected). The highest threat from this vulnerability is to system availability. (CVE-2020-10735)

  - Python 3.x through 3.10 has an open redirection vulnerability in lib/http/server.py due to no protection     against multiple (/) at the beginning of URI path which may leads to information disclosure. NOTE: this is     disputed by a third party because the http.server.html documentation page states Warning: http.server is     not recommended for production. It only implements basic security checks. (CVE-2021-28861)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5888-1 advisory.

    It was discovered that Python incorrectly handled certain inputs. If a user or an automated system were     tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to     execute arbitrary code. (CVE-2015-20107)

    Hamza Avvan discovered that Python incorrectly handled certain inputs. If a user or an automated system     were tricked into running a specially crafted input, a remote attacker could possibly use this issue to     execute arbitrary code. (CVE-2021-28861)

    It was discovered that Python incorrectly handled certain inputs. If a user or an automated system were     tricked into running a specially crafted input, a remote attacker could possibly use this issue to execute     arbitrary code. (CVE-2022-37454, CVE-2022-42919)

    It was discovered that Python incorrectly handled certain inputs. If a user or an automated system were     tricked into running a specially crafted input, a remote attacker could possibly use this issue to cause a     denial of service. (CVE-2022-45061, CVE-2023-24329)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2022:8353 advisory.

  - In Python (aka CPython) through 3.10.4, the mailcap module does not add escape characters into commands     discovered in the system mailcap file. This may allow attackers to inject shell commands into applications     that call mailcap.findmatch with untrusted input (if they lack validation of user-provided filenames or     arguments). (CVE-2015-20107)

  - ** DISPUTED ** Python 3.x through 3.10 has an open redirection vulnerability in lib/http/server.py due to     no protection against multiple (/) at the beginning of URI path which may leads to information disclosure.
    NOTE: this is disputed by a third party because the http.server.html documentation page states Warning:
    http.server is not recommended for production. It only implements basic security checks. (CVE-2021-28861)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
169178	Fedora 36 : pypy3.7 (2022-2173709172)	Nessus	Fedora Local Security Checks	12/23/2022	11/14/2024	high
185177	Fedora 39 : pypy3.10 (2023-ddde191e04)	Nessus	Fedora Local Security Checks	11/7/2023	11/14/2024	high
169166	Fedora 36 : mingw-python3 (2022-d1682fef04)	Nessus	Fedora Local Security Checks	12/22/2022	11/14/2024	high
211217	Fedora 37 : pypy3.8 (2022-20116fb6aa)	Nessus	Fedora Local Security Checks	11/14/2024	11/14/2024	high
211341	Fedora 38 : python3.6 (2022-2e93acb55d)	Nessus	Fedora Local Security Checks	11/14/2024	11/14/2024	high
165691	SUSE SLES12 Security Update : python3 (SUSE-SU-2022:3511-1)	Nessus	SuSE Local Security Checks	10/5/2022	7/14/2023	high
165610	SUSE SLES12 Security Update : python36 (SUSE-SU-2022:3483-1)	Nessus	SuSE Local Security Checks	10/1/2022	7/14/2023	high
166373	SUSE SLES12 Security Update : python3 (SUSE-SU-2022:3511-2)	Nessus	SuSE Local Security Checks	10/21/2022	7/14/2023	high
171722	RHEL 8 : python3 (RHSA-2023:0833)	Nessus	Red Hat Local Security Checks	2/21/2023	11/7/2024	high
171742	AlmaLinux 8 : python3 (ALSA-2023:0833)	Nessus	Alma Linux Local Security Checks	2/21/2023	9/1/2023	high
176305	Oracle Linux 8 : python39:3.9 / and / python39-devel:3.9 (ELSA-2023-2764)	Nessus	Oracle Linux Local Security Checks	5/24/2023	11/2/2024	high
171939	Ubuntu 20.04 ESM : Python vulnerabilities (USN-5888-1)	Nessus	Ubuntu Local Security Checks	2/28/2023	8/27/2024	critical
167866	AlmaLinux 9 : python3.9 (ALSA-2022:8353)	Nessus	Alma Linux Local Security Checks	11/18/2022	10/3/2023	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high

high

high

high

high

high

critical

high