The html.parser.HTMLParser class had worse-case quadratic complexity when processing certain crafted malformed inputs potentially leading to amplified denial-of-service.

vendor_unpatched cve-2025-6069: Unpatched CVEs for Debian Linux, Ubuntu Linux (cve-2025-6069)

The remote openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2025:02597-1 advisory.

    - CVE-2025-6069: Avoid worst case quadratic complexity when processing certain crafted malformed inputs     with HTMLParser (bsc#1244705).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2025:02523-1 advisory.

    - CVE-2025-6069: Fixed worst case quadratic complexity that can lead to amplified DoS. (bsc#1244705)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:02460-1 advisory.

    - CVE-2025-6069: Fixed worst case quadratic complexity that can lead to amplified DoS. (bsc#1244705)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-1941db8ecb advisory.

    Backport fix for CVE-2025-6069.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-c871432bf3 advisory.

    Backport fix for CVE-2025-6069.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:02359-1 advisory.

    - CVE-2025-6069: Avoid worst case quadratic complexity when processing certain crafted malformed inputs     with HTMLParser (bsc#1244705).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of python3 installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-6069 advisory.

  - The html.parser.HTMLParser class had worse-case quadratic complexity when processing certain crafted     malformed inputs potentially leading to amplified denial-of-service. (CVE-2025-6069)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:02358-1 advisory.

    - CVE-2025-6069: Avoid worst case quadratic complexity when processing certain crafted malformed inputs     with HTMLParser (bsc#1244705).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:02297-1 advisory.

    - CVE-2024-12718: Fixed extraction filter bypass that allowed file metadata modification outside     extraction directory (bsc#1244056)
    - CVE-2025-4138: Fixed issue that might allow symlink targets to point outside the destination directory,     and the modification of some file metadata (bsc#1244059)
    - CVE-2025-4330: Fixed extraction filter bypass that allowed linking outside extraction directory     (bsc#1244060)
    - CVE-2025-4435: Fixed Tarfile extracts filtered members when errorlevel=0 (bsc#1244061)
    - CVE-2025-4516: Fixed denial of service due to DecodeError handling vulnerability (bsc#1243273)
    - CVE-2025-4517: Fixed arbitrary filesystem writes outside the extraction directory during extraction with     filter='data' (bsc#1244032)
    - CVE-2025-6069: Fixed worst case quadratic complexity when processing certain crafted malformed inputs     with HTMLParser (bsc#1244705)

    Other fixes:
    - Add python36-* provides/obsoletes to enable SLE-12 -> SLE-15       migration (bsc#1233012)
    - Update vendored ipaddress module to 3.8 equivalent
    - Limit buffer size for IPv6 address parsing (bsc#1244401).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of python installed on the remote host is prior to 2.7.18-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-2911 advisory.

    The html.parser.HTMLParser class had worse-case quadratic complexity when processing certain crafted     malformed inputs potentially leading to amplified denial-of-service. (CVE-2025-6069)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1056 advisory.

    The html.parser.HTMLParser class had worse-case quadratic complexity when processing certain crafted     malformed inputs potentially leading to amplified denial-of-service. (CVE-2025-6069)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of python3 installed on the remote host is prior to 3.7.16-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-2923 advisory.

    There is an issue in CPython when using `bytes.decode(unicode_escape, error=ignore|replace)`. If you     are not using the unicode_escape encoding or an error handler your usage is not affected. To work-around     this issue you may stop using the error= handler and instead wrap the bytes.decode() call in a try-except     catching the DecodeError. (CVE-2025-4516)

    The html.parser.HTMLParser class had worse-case quadratic complexity when processing certain crafted     malformed inputs potentially leading to amplified denial-of-service. (CVE-2025-6069)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2025:02232-1 advisory.

    - CVE-2025-6069: Avoid worst case quadratic complexity when processing certain crafted malformed inputs     with HTMLParser (bsc#1244705).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
243302	openSUSE 15 Security Update : python310 (SUSE-SU-2025:02597-1)	Nessus	SuSE Local Security Checks	medium
242863	SUSE SLES12 Security Update : python (SUSE-SU-2025:02523-1)	Nessus	SuSE Local Security Checks	medium
242605	SUSE SLES15 / openSUSE 15 Security Update : python (SUSE-SU-2025:02460-1)	Nessus	SuSE Local Security Checks	medium
242498	Fedora 41 : mingw-python3 (2025-1941db8ecb)	Nessus	Fedora Local Security Checks	medium
242494	Fedora 42 : mingw-python3 (2025-c871432bf3)	Nessus	Fedora Local Security Checks	medium
242374	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : python312 (SUSE-SU-2025:02359-1)	Nessus	SuSE Local Security Checks	medium
242365	CBL Mariner 2.0 Security Update: python3 (CVE-2025-6069)	Nessus	MarinerOS Local Security Checks	medium
242307	SUSE SLES15 Security Update : python311 (SUSE-SU-2025:02358-1)	Nessus	SuSE Local Security Checks	medium
242011	SUSE SLES12 Security Update : python36 (SUSE-SU-2025:02297-1)	Nessus	SuSE Local Security Checks	critical
241750	Amazon Linux 2 : python (ALAS-2025-2911)	Nessus	Amazon Linux Local Security Checks	medium
241739	Amazon Linux 2023 : python3.12, python3.12-devel, python3.12-idle (ALAS2023-2025-1056)	Nessus	Amazon Linux Local Security Checks	medium
241738	Amazon Linux 2 : python3 (ALAS-2025-2923)	Nessus	Amazon Linux Local Security Checks	medium
241510	openSUSE 15 Security Update : python39 (SUSE-SU-2025:02232-1)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2025-6069

medium

Tenable Plugins

Coming Soon

medium

medium

medium

medium

medium

medium

medium

medium

critical

medium

medium

medium

medium