Detections
Analytics
NewStart CGSL CORE 5.05 / MAIN 5.05 : python3 Multiple Vulnerabilities (NS-SA-2021-0147)
medium Nessus Plugin ID 154450
Language:
Synopsis
The remote NewStart CGSL host is affected by multiple vulnerabilities.Description
The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has python3 packages installed that are affected by multiple vulnerabilities:- The documentation XML-RPC server in Python through 2.7.16, 3.x through 3.6.9, and 3.7.x through 3.7.4 has XSS via the server_title field. This occurs in Lib/DocXMLRPCServer.py in Python 2.x, and in Lib/xmlrpc/server.py in Python 3.x. If set_server_title is called with untrusted input, arbitrary JavaScript can be delivered to clients that visit the http URL for this server. (CVE-2019-16935)
- In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because _proc_pax lacks header validation. (CVE-2019-20907)
- Lib/ipaddress.py in Python through 3.8.3 improperly computes hash values in the IPv4Interface and IPv6Interface classes, which might allow a remote attacker to cause a denial of service if an application is affected by the performance of a dictionary containing IPv4Interface or IPv6Interface objects, and this attacker can cause many dictionary entries to be created. This is fixed in: v3.5.10, v3.5.10rc1; v3.6.12;
v3.7.9; v3.8.4, v3.8.4rc1, v3.8.5, v3.8.6, v3.8.6rc1; v3.9.0, v3.9.0b4, v3.9.0b5, v3.9.0rc1, v3.9.0rc2.
(CVE-2020-14422)
- Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTTP server to conduct Regular Expression Denial of Service (ReDoS) attacks against a client because of urllib.request.AbstractBasicAuthHandler catastrophic backtracking. (CVE-2020-8492)
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
Solution
Upgrade the vulnerable CGSL python3 packages. Note that updated packages may not be available yet. Please contact ZTE for more information.See Also
http://security.gd-linux.com/notice/NS-SA-2021-0147
http://security.gd-linux.com/info/CVE-2019-16935
http://security.gd-linux.com/info/CVE-2019-20907
Plugin Details
Severity: Medium
ID: 154450
File Name: newstart_cgsl_NS-SA-2021-0147_python3.nasl
Version: 1.3
Type: local
Published: 10/27/2021
Updated: 11/27/2023
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 4.4
CVSS v2
Risk Factor: Medium
Base Score: 4.3
Temporal Score: 3.4
Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N
CVSS Score Source: CVE-2019-16935
CVSS v3
Risk Factor: Medium
Base Score: 6.1
Temporal Score: 5.5
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C
Vulnerability Information
CPE: p-cpe:/a:zte:cgsl_core:python3-tkinter, p-cpe:/a:zte:cgsl_main:python3-test, p-cpe:/a:zte:cgsl_core:python3-libs, p-cpe:/a:zte:cgsl_core:python3-test, p-cpe:/a:zte:cgsl_main:python3-devel, cpe:/o:zte:cgsl_main:5, p-cpe:/a:zte:cgsl_main:python3-debug, p-cpe:/a:zte:cgsl_main:python3-tkinter, cpe:/o:zte:cgsl_core:5, p-cpe:/a:zte:cgsl_main:python3-idle, p-cpe:/a:zte:cgsl_core:python3-debug, p-cpe:/a:zte:cgsl_core:python3-idle, p-cpe:/a:zte:cgsl_main:python3, p-cpe:/a:zte:cgsl_core:python3, p-cpe:/a:zte:cgsl_core:python3-devel, p-cpe:/a:zte:cgsl_main:python3-libs
Required KB Items: Host/local_checks_enabled, Host/ZTE-CGSL/release, Host/ZTE-CGSL/rpm-list, Host/cpu
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 9/24/2021
Vulnerability Publication Date: 9/28/2019
Reference Information
CVE: CVE-2019-16935, CVE-2019-20907, CVE-2020-14422, CVE-2020-8492
IAVA: 2020-A-0103-S, 2020-A-0340-S