Improper parsing of HTTP requests in Pallets Werkzeug v2.1.0 and below allows attackers to perform HTTP Request Smuggling using a crafted HTTP request with multiple requests included inside the body. NOTE: the vendor's position is that this behavior can only occur in unsupported configurations involving development mode and an HTTP server from outside the Werkzeug project

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2025:0049 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2023-25577:
    Werkzeug is a comprehensive WSGI web application library. Prior to version 2.2.3, Werkzeug's multipart     form data parser will parse an unlimited number of parts, including file parts. Parts can be a small     amount of bytes, but each requires CPU time to parse and may use more memory as Python data. If a request     can be made to an endpoint that accesses `request.data`, `request.form`, `request.files`, or     `request.get_data(parse_form_data=False)`, it can cause unexpectedly high resource usage. This allows an     attacker to cause a denial of service by sending crafted multipart data to an endpoint that will parse it.
    The amount of CPU time required can block worker processes from handling legitimate requests. The amount     of RAM required can trigger an out of memory kill of the process. Unlimited file parts can use up memory     and file handles. If many concurrent requests are sent continuously, this can exhaust or kill all     available workers. Version 2.2.3 contains a patch for this issue.

    CVE-2023-23934:
    Werkzeug is a comprehensive WSGI web application library. Browsers may allow nameless cookies that look     like `=value` instead of `key=value`. A vulnerable browser may allow a compromised application on an     adjacent subdomain to exploit this to set a cookie like `=__Host-test=bad` for another subdomain. Werkzeug     prior to 2.2.3 will parse the cookie `=__Host-test=bad` as __Host-test=bad`. If a Werkzeug application is     running next to a vulnerable or malicious subdomain which sets such a cookie using a vulnerable browser,     the Werkzeug application will see the bad cookie value but the valid cookie key. The issue is fixed in     Werkzeug 2.2.3.

    CVE-2022-29361:
    ** DISPUTED ** Improper parsing of HTTP requests in Pallets Werkzeug v2.1.0 and below allows attackers to     perform HTTP Request Smuggling using a crafted HTTP request with multiple requests included inside the     body. NOTE: the vendor/'s position is that this behavior can only occur in unsupported configurations     involving development mode and an HTTP server from outside the Werkzeug project.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Improper parsing of HTTP requests in Pallets Werkzeug v2.1.0 and below allows attackers to perform HTTP
    Request Smuggling using a crafted HTTP request with multiple requests included inside the body. NOTE: the
    vendor's position is that this behavior can only occur in unsupported configurations involving development
    mode and an HTTP server from outside the Werkzeug project (CVE-2022-29361)

The version of Oracle Business Intelligence Enterprise Edition (OAS) 6.4.0.0.0 and 7.0.0.0 installed on the remote host are affected by a vulnerability as referenced in the July 2023 CPU advisory. 

  - Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics     (component: Analytics Server (Apache Hive)). Supported versions that are affected are 6.4.0.0.0,     7.0.0.0.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network     access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of     this vulnerability can result in unauthorized creation, deletion or modification access to critical data     or all Oracle Business Intelligence Enterprise Edition accessible data as well as unauthorized access to     critical data or complete access to all Oracle Business Intelligence Enterprise Edition accessible data.
    (CVE-2018-1282)

  - Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics     (component: Visual Analyzer (jackson-databind)). Supported versions that are affected are 6.4.0.0.0 and     7.0.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP     to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability     can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of     Oracle Business Intelligence Enterprise Edition. (CVE-2022-33980)

  - Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics     (component: Visual Analyzer (CKEditor)). Supported versions that are affected are 6.4.0.0.0 and     7.0.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP     to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks require human     interaction from a person other than the attacker and while the vulnerability is in Oracle Business     Intelligence Enterprise Edition, attacks may significantly impact additional products (scope change).     Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to     some of Oracle Business Intelligence Enterprise Edition accessible data as well as unauthorized read     access to a subset of Oracle Business Intelligence Enterprise Edition accessible data. (CVE-2023-28439)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
276278	TencentOS Server 4: python-werkzeug (TSSA-2025:0049)	Nessus	Tencent Local Security Checks	medium
426512	Alpine: multiple py3-werkzeug packages: security update to 2.2.2-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
426512	Alpine: multiple py3-werkzeug packages: security update to 2.2.2-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
406725	Alpine: multiple py3-werkzeug packages: security update to 2.2.2-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
406725	Alpine: multiple py3-werkzeug packages: security update to 2.2.2-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
178710	Oracle Business Intelligence Enterprise Edition (OAS) (July 2023 CPU)	Nessus	Misc.	critical

Detections

Analytics

CVE-2022-29361

critical

Tenable Plugins

medium

critical

critical

critical

critical

critical