The html.parser.HTMLParser class had worse-case quadratic complexity when processing certain crafted malformed inputs potentially leading to amplified denial-of-service.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:02297-1 advisory.

    - CVE-2024-12718: Fixed extraction filter bypass that allowed file metadata modification outside     extraction directory (bsc#1244056)
    - CVE-2025-4138: Fixed issue that might allow symlink targets to point outside the destination directory,     and the modification of some file metadata (bsc#1244059)
    - CVE-2025-4330: Fixed extraction filter bypass that allowed linking outside extraction directory     (bsc#1244060)
    - CVE-2025-4435: Fixed Tarfile extracts filtered members when errorlevel=0 (bsc#1244061)
    - CVE-2025-4516: Fixed denial of service due to DecodeError handling vulnerability (bsc#1243273)
    - CVE-2025-4517: Fixed arbitrary filesystem writes outside the extraction directory during extraction with     filter='data' (bsc#1244032)
    - CVE-2025-6069: Fixed worst case quadratic complexity when processing certain crafted malformed inputs     with HTMLParser (bsc#1244705)

    Other fixes:
    - Add python36-* provides/obsoletes to enable SLE-12 -> SLE-15       migration (bsc#1233012)
    - Update vendored ipaddress module to 3.8 equivalent
    - Limit buffer size for IPv6 address parsing (bsc#1244401).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of python installed on the remote host is prior to 2.7.18-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-2911 advisory.

    The html.parser.HTMLParser class had worse-case quadratic complexity when processing certain crafted     malformed inputs potentially leading to amplified denial-of-service. (CVE-2025-6069)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1056 advisory.

    The html.parser.HTMLParser class had worse-case quadratic complexity when processing certain crafted     malformed inputs potentially leading to amplified denial-of-service. (CVE-2025-6069)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of python3 installed on the remote host is prior to 3.7.16-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-2923 advisory.

    There is an issue in CPython when using `bytes.decode(unicode_escape, error=ignore|replace)`. If you     are not using the unicode_escape encoding or an error handler your usage is not affected. To work-around     this issue you may stop using the error= handler and instead wrap the bytes.decode() call in a try-except     catching the DecodeError. (CVE-2025-4516)

    The html.parser.HTMLParser class had worse-case quadratic complexity when processing certain crafted     malformed inputs potentially leading to amplified denial-of-service. (CVE-2025-6069)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2025:02232-1 advisory.

    - CVE-2025-6069: Avoid worst case quadratic complexity when processing certain crafted malformed inputs     with HTMLParser (bsc#1244705).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
242011	SUSE SLES12 Security Update : python36 (SUSE-SU-2025:02297-1)	Nessus	SuSE Local Security Checks	critical
241750	Amazon Linux 2 : python (ALAS-2025-2911)	Nessus	Amazon Linux Local Security Checks	medium
241739	Amazon Linux 2023 : python3.12, python3.12-devel, python3.12-idle (ALAS2023-2025-1056)	Nessus	Amazon Linux Local Security Checks	medium
241738	Amazon Linux 2 : python3 (ALAS-2025-2923)	Nessus	Amazon Linux Local Security Checks	medium
241510	openSUSE 15 Security Update : python39 (SUSE-SU-2025:02232-1)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2025-6069

medium

Tenable Plugins

critical

medium

medium

medium

medium