A use-after-free exists in Python through 3.9 via heappushpop in heapq.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - python: Heap overflow in zipimporter module (CVE-2016-5636)

  - python: XML External Entity in XML processing plistlib module (CVE-2022-48565)

  - CPython (aka Python) up to 2.7.13 is vulnerable to an integer overflow in the PyString_DecodeEscape     function in stringobject.c, resulting in heap-based buffer overflow (and possible arbitrary code     execution) (CVE-2017-1000158)

  - Python 2.7.14 is vulnerable to a Heap-Buffer-Overflow as well as a Heap-Use-After-Free. Python versions     prior to 2.7.14 may also be vulnerable and it appears that Python 2.7.17 and prior may also be vulnerable     however this has not been confirmed. The vulnerability lies when multiply threads are handling large     amounts of data. In both cases there is essentially a race condition that occurs. For the Heap-Buffer-     Overflow, Thread 2 is creating the size for a buffer, but Thread1 is already writing to the buffer without     knowing how much to write. So when a large amount of data is being processed, it is very easy to cause     memory corruption using a Heap-Buffer-Overflow. As for the Use-After-Free,     Thread3->Malloc->Thread1->Free's->Thread2-Re-uses-Free'd Memory. The PSRT has stated that this is not a     security vulnerability due to the fact that the attacker must be able to run code, however in some     situations, such as function as a service, this vulnerability can potentially be used by an attacker to     violate a trust boundary, as such the DWF feels this issue deserves a CVE. (CVE-2018-1000030)

  - python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic     backtracking in pop3lib's apop() method. An attacker could use this flaw to cause denial of service.
    (CVE-2018-1060)

  - python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic     backtracking in the difflib.IS_LINE_JUNK method. An attacker could use this flaw to cause denial of     service. (CVE-2018-1061)

  - Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization. This     could make it easy to conduct denial of service attacks against Expat by constructing an XML document that     would cause pathological hash collisions in Expat's internal data structures, consuming large amounts CPU     and RAM. The vulnerability exists in Python versions 3.7.0, 3.6.0 through 3.6.6, 3.5.0 through 3.5.6,     3.4.0 through 3.4.9, 2.7.0 through 2.7.15. (CVE-2018-14647)

  - http.cookiejar.DefaultPolicy.domain_return_ok in Lib/http/cookiejar.py in Python before 3.7.3 does not     correctly validate the domain: it can be tricked into sending existing cookies to the wrong server. An     attacker may abuse this flaw by using a server with a hostname that has another valid hostname as a suffix     (e.g., pythonicexample.com to steal cookies for example.com). When a program uses     http.cookiejar.DefaultPolicy and tries to do an HTTP connection to an attacker-controlled server, existing     cookies can be leaked to the attacker. This affects 2.x through 2.7.16, 3.x before 3.4.10, 3.5.x before     3.5.7, 3.6.x before 3.6.9, and 3.7.x before 3.7.3. (CVE-2018-20852)

  - An issue was discovered in Python through 2.7.16, 3.x through 3.5.7, 3.6.x through 3.6.9, and 3.7.x     through 3.7.4. The email module wrongly parses email addresses that contain multiple @ characters. An     application that uses the email module and implements some kind of checks on the From/To headers of a     message could be tricked into accepting an email address that should be denied. An attack may be the same     as in CVE-2019-11340; however, this CVE applies to Python more generally. (CVE-2019-16056)

  - The documentation XML-RPC server in Python through 2.7.16, 3.x through 3.6.9, and 3.7.x through 3.7.4 has     XSS via the server_title field. This occurs in Lib/DocXMLRPCServer.py in Python 2.x, and in     Lib/xmlrpc/server.py in Python 3.x. If set_server_title is called with untrusted input, arbitrary     JavaScript can be delivered to clients that visit the http URL for this server. (CVE-2019-16935)

  - An issue was discovered in urllib2 in Python 2.x through 2.7.17 and urllib in Python 3.x through 3.8.0.
    CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument     to urllib.request.urlopen with \r\n (specifically in the host component of a URL) followed by an HTTP     header. This is similar to the CVE-2019-9740 query string issue and the CVE-2019-9947 path string issue.
    (This is not exploitable when glibc has CVE-2016-10739 fixed.). This is fixed in: v2.7.18, v2.7.18rc1;
    v3.5.10, v3.5.10rc1; v3.6.11, v3.6.11rc1, v3.6.12; v3.7.8, v3.7.8rc1, v3.7.9; v3.8.3, v3.8.3rc1, v3.8.4,     v3.8.4rc1, v3.8.5, v3.8.6, v3.8.6rc1. (CVE-2019-18348)

  - In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an     infinite loop when opened by tarfile.open, because _proc_pax lacks header validation. (CVE-2019-20907)

  - Lib/zipfile.py in Python through 3.7.2 allows remote attackers to cause a denial of service (resource     consumption) via a ZIP bomb. (CVE-2019-9674)

  - An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3.
    CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument     to urllib.request.urlopen with \r\n (specifically in the query string after a ? character) followed by an     HTTP header or a Redis command. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10,     v3.5.10rc1, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12,     v3.6.9, v3.6.9rc1; v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1,     v3.7.8, v3.7.8rc1, v3.7.9. (CVE-2019-9740)

  - An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3.
    CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument     to urllib.request.urlopen with \r\n (specifically in the path component of a URL that lacks a ? character)     followed by an HTTP header or a Redis command. This is similar to the CVE-2019-9740 query string issue.
    This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.8, v3.5.8rc1,     v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.4,     v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9.
    (CVE-2019-9947)

  - urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote     attackers to bypass protection mechanisms that blacklist file: URIs, as demonstrated by triggering a     urllib.urlopen('local_file:///etc/passwd') call. (CVE-2019-9948)

  - A flaw was found in python. In algorithms with quadratic time complexity using non-binary bases, when     using int(text), a system could take 50ms to parse an int string with 100,000 digits and 5s for     1,000,000 digits (float, decimal, int.from_bytes(), and int() for binary bases 2, 4, 8, 16, and 32 are not     affected). The highest threat from this vulnerability is to system availability. (CVE-2020-10735)

  - Lib/ipaddress.py in Python through 3.8.3 improperly computes hash values in the IPv4Interface and     IPv6Interface classes, which might allow a remote attacker to cause a denial of service if an application     is affected by the performance of a dictionary containing IPv4Interface or IPv6Interface objects, and this     attacker can cause many dictionary entries to be created. This is fixed in: v3.5.10, v3.5.10rc1; v3.6.12;
    v3.7.9; v3.8.4, v3.8.4rc1, v3.8.5, v3.8.6, v3.8.6rc1; v3.9.0, v3.9.0b4, v3.9.0b5, v3.9.0rc1, v3.9.0rc2.
    (CVE-2020-14422)

  - http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5     allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR     and LF control characters in the first argument of HTTPConnection.request. (CVE-2020-26116)

  - In Python 3 through 3.9.0, the Lib/test/multibytecodec_support.py CJK codec tests call eval() on content     retrieved via HTTP. (CVE-2020-27619)

  - Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1     allows an HTTP server to conduct Regular Expression Denial of Service (ReDoS) attacks against a client     because of urllib.request.AbstractBasicAuthHandler catastrophic backtracking. (CVE-2020-8492)

  - The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before     3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to Web Cache Poisoning via urllib.parse.parse_qsl and     urllib.parse.parse_qs by using a vector called parameter cloaking. When the attacker can separate query     parameters using a semicolon (;), they can cause a difference in the interpretation of the request between     the proxy (running with default configuration) and the server. This can result in malicious requests being     cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and     therefore would not include it in a cache key of an unkeyed parameter. (CVE-2021-23336)

  - Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to     remote code execution in certain Python applications that accept floating-point numbers as untrusted     input, as demonstrated by a 1e300 argument to c_double.from_param. This occurs because sprintf is used     unsafely. (CVE-2021-3177)

  - There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP     server that an HTTP client (such as web browser) connects to, could trigger a Regular Expression Denial of     Service (ReDOS) during an authentication request with a specially crafted payload that is sent by the     server to the client. The greatest threat that this flaw poses is to application availability.
    (CVE-2021-3733)

  - A flaw was found in python. An improperly handled HTTP response in the HTTP client code of python may     allow a remote attacker, who controls the HTTP server, to make the client script enter an infinite loop,     consuming CPU time. The highest threat from this vulnerability is to system availability. (CVE-2021-3737)

  - A flaw was found in Python, specifically in the FTP (File Transfer Protocol) client library in PASV     (passive) mode. The issue is how the FTP client trusts the host from the PASV response by default. This     flaw allows an attacker to set up a malicious FTP server that can trick FTP clients into connecting back     to a given IP address and port. This vulnerability could lead to FTP client scanning ports, which     otherwise would not have been possible. (CVE-2021-4189)

  - A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform     Resource Locator (URL) strings into components. The issue involves how the urlparse method does not     sanitize input and allows characters like '\r' and '\n' in the URL path. This flaw allows an attacker to     input a crafted URL, leading to injection attacks. This flaw affects Python versions prior to 3.10.0b1,     3.9.5, 3.8.11, 3.7.11 and 3.6.14. (CVE-2022-0391)

  - An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path     when processing some inputs to the IDNA (RFC 3490) decoder, such that a crafted, unreasonably long name     being presented to the decoder could lead to a CPU denial of service. Hostnames are often supplied by     remote servers that could be controlled by a malicious actor; in such a scenario, they could trigger     excessive CPU consumption on the client attempting to make use of an attacker-supplied supposed hostname.
    For example, the attack payload could be placed in the Location header of an HTTP response with status     code 302. A fix is planned in 3.11.1, 3.10.9, 3.9.16, 3.8.16, and 3.7.16. (CVE-2022-45061)

  - A use-after-free exists in Python through 3.9 via heappushpop in heapq. (CVE-2022-48560)

  - An issue was discovered in compare_digest in Lib/hmac.py in Python through 3.9.1. Constant-time-defeating     optimisations were possible in the accumulator variable in hmac.compare_digest. (CVE-2022-48566)

  - The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special     character. The wrong portion of an RFC2822 header is identified as the value of the addr-spec. In some     applications, an attacker can bypass a protection mechanism in which application access is granted only     after verifying receipt of e-mail to a specific domain (e.g., only @company.example.com addresses may be     used for signup). This occurs in email/_parseaddr.py in recent versions of Python. (CVE-2023-27043)

  - The legacy email.utils.parseaddr function in Python through 3.11.4 allows attackers to trigger     RecursionError: maximum recursion depth exceeded while calling a Python object via a crafted argument.
    This argument is plausibly an untrusted value from an application's input data that was supposed to     contain a name and an e-mail address. NOTE: email.utils.parseaddr is categorized as a Legacy API in the     documentation of the Python email package. Applications should instead use the email.parser.BytesParser or     email.parser.Parser class. NOTE: the vendor's perspective is that this is neither a vulnerability nor a     bug. The email package is intended to have size limits and to throw an exception when limits are exceeded;
    they were exceeded by the example demonstration code. (CVE-2023-36632)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - python: Stack-based buffer overflow in PyCArg_repr in _ctypes/callproc.c (CVE-2021-3177)

  - python: XML External Entity in XML processing plistlib module (CVE-2022-48565)

  - CPython (aka Python) up to 2.7.13 is vulnerable to an integer overflow in the PyString_DecodeEscape     function in stringobject.c, resulting in heap-based buffer overflow (and possible arbitrary code     execution) (CVE-2017-1000158)

  - Python 2.7.14 is vulnerable to a Heap-Buffer-Overflow as well as a Heap-Use-After-Free. Python versions     prior to 2.7.14 may also be vulnerable and it appears that Python 2.7.17 and prior may also be vulnerable     however this has not been confirmed. The vulnerability lies when multiply threads are handling large     amounts of data. In both cases there is essentially a race condition that occurs. For the Heap-Buffer-     Overflow, Thread 2 is creating the size for a buffer, but Thread1 is already writing to the buffer without     knowing how much to write. So when a large amount of data is being processed, it is very easy to cause     memory corruption using a Heap-Buffer-Overflow. As for the Use-After-Free,     Thread3->Malloc->Thread1->Free's->Thread2-Re-uses-Free'd Memory. The PSRT has stated that this is not a     security vulnerability due to the fact that the attacker must be able to run code, however in some     situations, such as function as a service, this vulnerability can potentially be used by an attacker to     violate a trust boundary, as such the DWF feels this issue deserves a CVE. (CVE-2018-1000030)

  - Lib/zipfile.py in Python through 3.7.2 allows remote attackers to cause a denial of service (resource     consumption) via a ZIP bomb. (CVE-2019-9674)

  - A flaw was found in python. In algorithms with quadratic time complexity using non-binary bases, when     using int(text), a system could take 50ms to parse an int string with 100,000 digits and 5s for     1,000,000 digits (float, decimal, int.from_bytes(), and int() for binary bases 2, 4, 8, 16, and 32 are not     affected). The highest threat from this vulnerability is to system availability. (CVE-2020-10735)

  - In Python 3 through 3.9.0, the Lib/test/multibytecodec_support.py CJK codec tests call eval() on content     retrieved via HTTP. (CVE-2020-27619)

  - The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before     3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to Web Cache Poisoning via urllib.parse.parse_qsl and     urllib.parse.parse_qs by using a vector called parameter cloaking. When the attacker can separate query     parameters using a semicolon (;), they can cause a difference in the interpretation of the request between     the proxy (running with default configuration) and the server. This can result in malicious requests being     cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and     therefore would not include it in a cache key of an unkeyed parameter. (CVE-2021-23336)

  - Python 3.x through 3.10 has an open redirection vulnerability in lib/http/server.py due to no protection     against multiple (/) at the beginning of URI path which may leads to information disclosure. NOTE: this is     disputed by a third party because the http.server.html documentation page states Warning: http.server is     not recommended for production. It only implements basic security checks. (CVE-2021-28861)

  - There's a flaw in Python 3's pydoc. A local or adjacent attacker who discovers or is able to convince     another local or adjacent user to start a pydoc server could access the server and use it to disclose     sensitive information belonging to the other user that they would not normally be able to access. The     highest risk of this flaw is to data confidentiality. This flaw affects Python versions before 3.8.9,     Python versions before 3.9.3 and Python versions before 3.10.0a7. (CVE-2021-3426)

  - There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP     server that an HTTP client (such as web browser) connects to, could trigger a Regular Expression Denial of     Service (ReDOS) during an authentication request with a specially crafted payload that is sent by the     server to the client. The greatest threat that this flaw poses is to application availability.
    (CVE-2021-3733)

  - A flaw was found in python. An improperly handled HTTP response in the HTTP client code of python may     allow a remote attacker, who controls the HTTP server, to make the client script enter an infinite loop,     consuming CPU time. The highest threat from this vulnerability is to system availability. (CVE-2021-3737)

  - A flaw was found in Python, specifically in the FTP (File Transfer Protocol) client library in PASV     (passive) mode. The issue is how the FTP client trusts the host from the PASV response by default. This     flaw allows an attacker to set up a malicious FTP server that can trick FTP clients into connecting back     to a given IP address and port. This vulnerability could lead to FTP client scanning ports, which     otherwise would not have been possible. (CVE-2021-4189)

  - A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform     Resource Locator (URL) strings into components. The issue involves how the urlparse method does not     sanitize input and allows characters like '\r' and '\n' in the URL path. This flaw allows an attacker to     input a crafted URL, leading to injection attacks. This flaw affects Python versions prior to 3.10.0b1,     3.9.5, 3.8.11, 3.7.11 and 3.6.14. (CVE-2022-0391)

  - An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path     when processing some inputs to the IDNA (RFC 3490) decoder, such that a crafted, unreasonably long name     being presented to the decoder could lead to a CPU denial of service. Hostnames are often supplied by     remote servers that could be controlled by a malicious actor; in such a scenario, they could trigger     excessive CPU consumption on the client attempting to make use of an attacker-supplied supposed hostname.
    For example, the attack payload could be placed in the Location header of an HTTP response with status     code 302. A fix is planned in 3.11.1, 3.10.9, 3.9.16, 3.8.16, and 3.7.16. (CVE-2022-45061)

  - A use-after-free exists in Python through 3.9 via heappushpop in heapq. (CVE-2022-48560)

  - read_ints in plistlib.py in Python through 3.9.1 is vulnerable to a potential DoS attack via CPU and RAM     exhaustion when processing malformed Apple Property List files in binary format. (CVE-2022-48564)

  - An issue was discovered in compare_digest in Lib/hmac.py in Python through 3.9.1. Constant-time-defeating     optimisations were possible in the accumulator variable in hmac.compare_digest. (CVE-2022-48566)

  - The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special     character. The wrong portion of an RFC2822 header is identified as the value of the addr-spec. In some     applications, an attacker can bypass a protection mechanism in which application access is granted only     after verifying receipt of e-mail to a specific domain (e.g., only @company.example.com addresses may be     used for signup). This occurs in email/_parseaddr.py in recent versions of Python. (CVE-2023-27043)

  - The legacy email.utils.parseaddr function in Python through 3.11.4 allows attackers to trigger     RecursionError: maximum recursion depth exceeded while calling a Python object via a crafted argument.
    This argument is plausibly an untrusted value from an application's input data that was supposed to     contain a name and an e-mail address. NOTE: email.utils.parseaddr is categorized as a Legacy API in the     documentation of the Python email package. Applications should instead use the email.parser.BytesParser or     email.parser.Parser class. NOTE: the vendor's perspective is that this is neither a vulnerability nor a     bug. The email package is intended to have size limits and to throw an exception when limits are exceeded;
    they were exceeded by the example demonstration code. (CVE-2023-36632)

  - An issue was found in the CPython `zipfile` module affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and     3.8.18 and prior. The zipfile module is vulnerable to quoted-overlap zip-bombs which exploit the zip     format to create a zip-bomb with a high compression ratio. The fixed versions of CPython makes the zipfile     module reject zip archives which overlap entries in the archive. (CVE-2024-0450)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Fedora 40 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-7bad83a2e2 advisory.

  - A use-after-free exists in Python through 3.9 via heappushpop in heapq. (CVE-2022-48560)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the python2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A use-after-free exists in Python through 3.9 via heappushpop in heapq. (CVE-2022-48560)

  - An XML External Entity (XXE) issue was discovered in Python through 3.9.1. The plistlib module no longer     accepts entity declarations in XML plist files to avoid XML vulnerabilities. (CVE-2022-48565)

  - An issue was discovered in compare_digest in Lib/hmac.py in Python through 3.9.1. Constant-time-defeating     optimisations were possible in the accumulator variable in hmac.compare_digest. (CVE-2022-48566)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the python packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A use-after-free exists in Python through 3.9 via heappushpop in heapq. (CVE-2022-48560)

  - An XML External Entity (XXE) issue was discovered in Python through 3.9.1. The plistlib module no longer     accepts entity declarations in XML plist files to avoid XML vulnerabilities. (CVE-2022-48565)

  - An issue was discovered in compare_digest in Lib/hmac.py in Python through 3.9.1. Constant-time-defeating     optimisations were possible in the accumulator variable in hmac.compare_digest. (CVE-2022-48566)

  - An issue was discovered in Python before 3.8.18, 3.9.x before 3.9.18, 3.10.x before 3.10.13, and 3.11.x     before 3.11.5. It primarily affects servers (such as HTTP servers) that use TLS client authentication. If     a TLS server-side socket is created, receives data into the socket buffer, and then is closed quickly,     there is a brief window where the SSLSocket instance will detect the socket as 'not connected' and won't     initiate a handshake, but buffered data will still be readable from the socket buffer. This data will not     be authenticated if the server-side TLS peer is expecting client certificate authentication, and is     indistinguishable from valid TLS stream data. Data is limited in size to the amount that will fit in the     buffer. (The TLS connection cannot directly be used for data exfiltration because the vulnerable code path     requires that the connection be closed on initialization of the SSLSocket.) (CVE-2023-40217)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0586 advisory.

  - python: use after free in heappushpop() of heapq module (CVE-2022-48560)

  - python: DoS when processing malformed Apple Property List files in binary format (CVE-2022-48564)

  - python: Parsing errors in email/_parseaddr.py lead to incorrect value in email address part of tuple     (CVE-2023-27043)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0430 advisory.

  - python: tarfile module directory traversal (CVE-2007-4559)

  - python: int() type in PyLong_FromString() does not limit amount of digits converting text to int leading     to DoS (CVE-2020-10735)

  - python: CPU denial of service via inefficient IDNA decoder (CVE-2022-45061)

  - python: use after free in heappushpop() of heapq module (CVE-2022-48560)

  - python: DoS when processing malformed Apple Property List files in binary format (CVE-2022-48564)

  - python: Parsing errors in email/_parseaddr.py lead to incorrect value in email address part of tuple     (CVE-2023-27043)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-0114 advisory.

  - A use-after-free exists in Python through 3.9 via heappushpop in heapq. (CVE-2022-48560)

  - read_ints in plistlib.py in Python through 3.9.1 is vulnerable to a potential DoS attack via CPU and RAM     exhaustion when processing malformed Apple Property List files in binary format. (CVE-2022-48564)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0114 advisory.

  - python: use after free in heappushpop() of heapq module (CVE-2022-48560)

  - python: DoS when processing malformed Apple Property List files in binary format (CVE-2022-48564)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2024:0114 advisory.

  - A use-after-free exists in Python through 3.9 via heappushpop in heapq. (CVE-2022-48560)

  - read_ints in plistlib.py in Python through 3.9.1 is vulnerable to a potential DoS attack via CPU and RAM     exhaustion when processing malformed Apple Property List files in binary format. (CVE-2022-48564)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-9954dae554 advisory.

  - A use-after-free exists in Python through 3.9 via heappushpop in heapq. (CVE-2022-48560)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-34a3a5adba advisory.

  - A use-after-free exists in Python through 3.9 via heappushpop in heapq. (CVE-2022-48560)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 ESM / 18.04 ESM host has packages installed that are affected by a vulnerability as referenced in the USN-6394-2 advisory.

  - A use-after-free exists in Python through 3.9 via heappushpop in heapq. (CVE-2022-48560)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3614 advisory.

  - A use-after-free exists in Python through 3.9 via heappushpop in heapq. (CVE-2022-48560)

  - read_ints in plistlib.py in Python through 3.9.1 is vulnerable to a potential DoS attack via CPU and RAM     exhaustion when processing malformed Apple Property List files in binary format. (CVE-2022-48564)

  - An XML External Entity (XXE) issue was discovered in Python through 3.9.1. The plistlib module no longer     accepts entity declarations in XML plist files to avoid XML vulnerabilities. (CVE-2022-48565)

  - An issue was discovered in compare_digest in Lib/hmac.py in Python through 3.9.1. Constant-time-defeating     optimisations were possible in the accumulator variable in hmac.compare_digest. (CVE-2022-48566)

  - An issue was discovered in Python before 3.8.18, 3.9.x before 3.9.18, 3.10.x before 3.10.13, and 3.11.x     before 3.11.5. It primarily affects servers (such as HTTP servers) that use TLS client authentication. If     a TLS server-side socket is created, receives data into the socket buffer, and then is closed quickly,     there is a brief window where the SSLSocket instance will detect the socket as not connected and won't     initiate a handshake, but buffered data will still be readable from the socket buffer. This data will not     be authenticated if the server-side TLS peer is expecting client certificate authentication, and is     indistinguishable from valid TLS stream data. Data is limited in size to the amount that will fit in the     buffer. (The TLS connection cannot directly be used for data exfiltration because the vulnerable code path     requires that the connection be closed on initialization of the SSLSocket.) (CVE-2023-40217)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 ESM host has packages installed that are affected by a vulnerability as referenced in the USN-6394-1 advisory.

  - A use-after-free exists in Python through 3.9 via heappushpop in heapq. (CVE-2022-48560)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3575 advisory.

  - The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before     3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to Web Cache Poisoning via urllib.parse.parse_qsl and     urllib.parse.parse_qs by using a vector called parameter cloaking. When the attacker can separate query     parameters using a semicolon (;), they can cause a difference in the interpretation of the request between     the proxy (running with default configuration) and the server. This can result in malicious requests being     cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and     therefore would not include it in a cache key of an unkeyed parameter. (CVE-2021-23336)

  - A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform     Resource Locator (URL) strings into components. The issue involves how the urlparse method does not     sanitize input and allows characters like '\r' and '\n' in the URL path. This flaw allows an attacker to     input a crafted URL, leading to injection attacks. This flaw affects Python versions prior to 3.10.0b1,     3.9.5, 3.8.11, 3.7.11 and 3.6.14. (CVE-2022-0391)

  - A use-after-free exists in Python through 3.9 via heappushpop in heapq. (CVE-2022-48560)

  - An XML External Entity (XXE) issue was discovered in Python through 3.9.1. The plistlib module no longer     accepts entity declarations in XML plist files to avoid XML vulnerabilities. (CVE-2022-48565)

  - An issue was discovered in compare_digest in Lib/hmac.py in Python through 3.9.1. Constant-time-defeating     optimisations were possible in the accumulator variable in hmac.compare_digest. (CVE-2022-48566)

  - An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting     methods by supplying a URL that starts with blank characters. (CVE-2023-24329)

  - An issue was discovered in Python before 3.8.18, 3.9.x before 3.9.18, 3.10.x before 3.10.13, and 3.11.x     before 3.11.5. It primarily affects servers (such as HTTP servers) that use TLS client authentication. If     a TLS server-side socket is created, receives data into the socket buffer, and then is closed quickly,     there is a brief window where the SSLSocket instance will detect the socket as not connected and won't     initiate a handshake, but buffered data will still be readable from the socket buffer. This data will not     be authenticated if the server-side TLS peer is expecting client certificate authentication, and is     indistinguishable from valid TLS stream data. Data is limited in size to the amount that will fit in the     buffer. (The TLS connection cannot directly be used for data exfiltration because the vulnerable code path     requires that the connection be closed on initialization of the SSLSocket.) (CVE-2023-40217)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTTP server to conduct Regular Expression Denial of Service (ReDoS) attacks against a client because of urllib.request.AbstractBasicAuthHandler catastrophic backtracking. (CVE-2020-8492)

ID	Name	Product	Family	Severity
196757	RHEL 6 : python (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
196743	RHEL 7 : python (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
194548	Fedora 40 : python2.7 (2023-7bad83a2e2)	Nessus	Fedora Local Security Checks	high
191889	EulerOS 2.0 SP8 : python2 (EulerOS-SA-2024-1290)	Nessus	Huawei Local Security Checks	critical
190314	EulerOS 2.0 SP5 : python (EulerOS-SA-2024-1160)	Nessus	Huawei Local Security Checks	critical
189784	RHEL 8 : python3 (RHSA-2024:0586)	Nessus	Red Hat Local Security Checks	medium
189538	RHEL 8 : python3 (RHSA-2024:0430)	Nessus	Red Hat Local Security Checks	medium
187931	Oracle Linux 8 : python3 (ELSA-2024-0114)	Nessus	Oracle Linux Local Security Checks	high
187893	RHEL 8 : python3 (RHSA-2024:0114)	Nessus	Red Hat Local Security Checks	high
187871	CentOS 8 : python3 (CESA-2024:0114)	Nessus	CentOS Local Security Checks	high
186679	Fedora 39 : python2.7 (2023-9954dae554)	Nessus	Fedora Local Security Checks	high
186678	Fedora 38 : python2.7 (2023-34a3a5adba)	Nessus	Fedora Local Security Checks	high
183232	Ubuntu 16.04 ESM / 18.04 ESM : Python vulnerability (USN-6394-2)	Nessus	Ubuntu Local Security Checks	high
182942	Debian DLA-3614-1 : python3.7 - LTS security update	Nessus	Debian Local Security Checks	critical
181767	Ubuntu 16.04 ESM : Python vulnerability (USN-6394-1)	Nessus	Ubuntu Local Security Checks	high
181697	Debian DLA-3575-1 : python2.7 - LTS security update	Nessus	Debian Local Security Checks	critical
139339	Amazon Linux 2 : python, python3 (ALAS-2020-1471)	Nessus	Amazon Linux Local Security Checks	high

Detections

Analytics

CVE-2022-48560

high

Tenable Plugins

critical

critical

high

critical

critical

medium

medium

high

high

high

high

high

high

critical

high

critical

high