The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:3706-1 advisory.

    Update to version 3.13.7.

    - Fixes in 3.13.7:
      * gh-137583: Fix a deadlock introduced in 3.13.6 when a call         to ssl.SSLSocket.recv was blocked in one thread, and then         another method on the object (such as ssl.SSLSocket.send) was         subsequently called in another thread.
      * gh-137044: Return large limit values as positive integers         instead of negative integers in resource.getrlimit().
        Accept large values and reject negative values (except         RLIM_INFINITY) for limits in resource.setrlimit().
      * gh-136914: Fix retrieval of doctest.DocTest.lineno         for objects decorated with functools.cache() or         functools.cached_property.
      * gh-131788: Make ResourceTracker.send from multiprocessing         re-entrant safe
      * gh-136155: We are now checking for fatal errors in EPUB         builds in CI.
      * gh-137400: Fix a crash in the free threading build when         disabling profiling or tracing across all threads with         PyEval_SetProfileAllThreads() or PyEval_SetTraceAllThreads()         or their Python equivalents threading.settrace_all_threads()         and threading.setprofile_all_threads().

    - Fixes in 3.13.6:
      * Security
        - gh-135661: Fix parsing start and end tags in           html.parser.HTMLParser according to the HTML5 standard.
            - Whitespaces no longer accepted between </ and the tag               name. E.g. </ script> does not end the script section.
            - Vertical tabulation (\v) and non-ASCII whitespaces no               longer recognized as whitespaces. The only whitespaces               are \t\n\r\f and space.
            - Null character (U+0000) no longer ends the tag name.
            - Attributes and slashes after the tag name in end tags               are now ignored, instead of terminating after the first               > in quoted attribute value. E.g. </script/foo='>'/>.
            - Multiple slashes and whitespaces between the last               attribute and closing > are now ignored in both start               and end tags. E.g. <a foo=bar/ //>.
            - Multiple = between attribute name and value are no               longer collapsed. E.g. <a foo==bar> produces attribute               foo with value =bar.
        - gh-102555: Fix comment parsing in html.parser.HTMLParser           according to the HTML5 standard. --!> now ends the comment.
          -- > no longer ends the comment. Support abnormally ended           empty comments <--> and <--->.
        - gh-135462: Fix quadratic complexity in processing specially           crafted input in html.parser.HTMLParser. End-of-file errors           are now handled according to the HTML5 specs  comments and           declarations are automatically closed, tags are ignored           (CVE-2025-6069, bsc#1244705).
        - gh-118350: Fix support of escapable raw text mode (elements           textarea and title) in html.parser.HTMLParser.
      * Core and Builtins
        - gh-58124: Fix name of the Python encoding in Unicode errors           of the code page codec: use cp65000 and cp65001 instead           of CP_UTF7 and CP_UTF8 which are not valid Python code           names. Patch by Victor Stinner.
        - gh-137314: Fixed a regression where raw f-strings           incorrectly interpreted escape sequences in format           specifications. Raw f-strings now properly preserve literal           backslashes in format specs, matching the behavior from           Python 3.11. For example, rf'{obj:\xFF}' now correctly           produces '\\xFF' instead of '?'. Patch by Pablo Galindo.
        - gh-136541: Fix some issues with the perf trampolines           on x86-64 and aarch64. The trampolines were not being           generated correctly for some cases, which could lead to           the perf integration not working correctly. Patch by Pablo           Galindo.
        - gh-109700: Fix memory error handling in           PyDict_SetDefault().
        - gh-78465: Fix error message for cls.__new__(cls, ...) where           cls is not instantiable builtin or extension type (with           tp_new set to NULL).
        - gh-135871: Non-blocking mutex lock attempts now return           immediately when the lock is busy instead of briefly           spinning in the free threading build.
        - gh-135607: Fix potential weakref races in an objects           destructor on the free threaded build.
        - gh-135496: Fix typo in the f-string conversion type error           (exclamanation -> exclamation).
        - gh-130077: Properly raise custom syntax errors when           incorrect syntax containing names that are prefixes of soft           keywords is encountered. Patch by Pablo Galindo.
        - gh-135148: Fixed a bug where f-string debug expressions           (using =) would incorrectly strip out parts of strings           containing escaped quotes and # characters. Patch by Pablo           Galindo.
        - gh-133136: Limit excess memory usage in the free threading           build when a large dictionary or list is resized and           accessed by multiple threads.
        - gh-132617: Fix dict.update() modification check that could           incorrectly raise a dict mutated during update error when           a different dictionary was modified that happens to share           the same underlying keys object.
        - gh-91153: Fix a crash when a bytearray is concurrently           mutated during item assignment.
        - gh-127971: Fix off-by-one read beyond the end of a string           in string search.
        - gh-125723: Fix crash with gi_frame.f_locals when generator           frames outlive their generator. Patch by Mikhail Efimov.
      * Library
        - gh-132710: If possible, ensure that uuid.getnode()           returns the same result even across different processes.
          Previously, the result was constant only within the same           process. Patch by B?n?dikt Tran.
        - gh-137273: Fix debug assertion failure in           locale.setlocale() on Windows.
        - gh-137257: Bump the version of pip bundled in ensurepip to           version 25.2
        - gh-81325: tarfile.TarFile now accepts a path-like when           working on a tar archive. (Contributed by Alexander Enrique           Urieles Nieto in gh-81325.)
        - gh-130522: Fix unraisable TypeError raised during           interpreter shutdown in the threading module.
        - gh-130577: tarfile now validates archives to ensure member           offsets are non-negative. (Contributed by Alexander Enrique           Urieles Nieto in gh-130577; CVE-2025-8194, bsc#1247249).
        - gh-136549: Fix signature of threading.excepthook().
        - gh-136523: Fix wave.Wave_write emitting an unraisable when           open raises.
        - gh-52876: Add missing keepends (default True)           parameter to codecs.StreamReaderWriter.readline() and           codecs.StreamReaderWriter.readlines().
        - gh-85702: If zoneinfo._common.load_tzdata is given a           package without a resource a zoneinfo.ZoneInfoNotFoundError           is raised rather than a PermissionError. Patch by Victor           Stinner.
        - gh-134759: Fix UnboundLocalError in           email.message.Message.get_payload() when the payload to           decode is a bytes object. Patch by Kliment Lamonov.
        - gh-136028: Fix parsing month names containing  (U+0130,           LATIN CAPITAL LETTER I WITH DOT ABOVE) in time.strptime().
          This affects locales az_AZ, ber_DZ, ber_MA and crh_UA.
        - gh-135995: In the palmos encoding, make byte 0x9b decode to            (U+203A - SINGLE RIGHT-POINTING ANGLE QUOTATION MARK).
        - gh-53203: Fix time.strptime() for %c and %x formats on           locales byn_ER, wal_ET and lzh_TW, and for %X format on           locales ar_SA, bg_BG and lzh_TW.
        - gh-91555: An earlier change, which was introduced in           3.13.4, has been reverted. It disabled logging for a logger           during handling of log messages for that logger. Since the           reversion, the behaviour should be as it was before 3.13.4.
        - gh-135878: Fixes a crash of types.SimpleNamespace on free           threading builds, when several threads were calling its
          __repr__() method at the same time.
        - gh-135836: Fix IndexError in           asyncio.loop.create_connection() that could occur when           non-OSError exception is raised during connection and           sockets close() raises OSError.
        - gh-135836: Fix IndexError in           asyncio.loop.create_connection() that could occur when the           Happy Eyeballs algorithm resulted in an empty exceptions           list during connection attempts.
        - gh-135855: Raise TypeError instead of SystemError when
          _interpreters.set___main___attrs() is passed a non-dict           object. Patch by Brian Schubert.
        - gh-135815: netrc: skip security checks if os.getuid() is           missing. Patch by B?n?dikt Tran.
        - gh-135640: Address bug where it was possible to call           xml.etree.ElementTree.ElementTree.write() on an ElementTree           object with an invalid root element. This behavior blanked           the file passed to write if it already existed.
        - gh-135444: Fix asyncio.DatagramTransport.sendto() to           account for datagram header size when data cannot be sent.
        - gh-135497: Fix os.getlogin() failing for longer usernames           on BSD-based platforms.
        - gh-135487: Fix reprlib.Repr.repr_int() when given integers           with more than sys.get_int_max_str_digits() digits. Patch           by B?n?dikt Tran.
        - gh-135335: multiprocessing: Flush stdout and stderr after           preloading modules in the forkserver.
        - gh-135244: uuid: when the MAC address cannot be           determined, the 48-bit node ID is now generated with a           cryptographically-secure pseudo-random number generator           (CSPRNG) as per RFC 9562, ?6.10.3. This affects uuid1().
        - gh-135069: Fix the Invalid error handling exception in           encodings.idna.IncrementalDecoder to correctly replace the           errors parameter.
        - gh-134698: Fix a crash when calling methods of           ssl.SSLContext or ssl.SSLSocket across multiple threads.
        - gh-132124: On POSIX-compliant systems,           multiprocessing.util.get_temp_dir() now ignores TMPDIR           (and similar environment variables) if the path length of           AF_UNIX socket files exceeds the platform-specific maximum           length when using the forkserver start method. Patch by           B?n?dikt Tran.
        - gh-133439: Fix dot commands with trailing spaces are           mistaken for multi-line SQL statements in the sqlite3           command-line interface.
        - gh-132969: Prevent the ProcessPoolExecutor executor thread,           which remains running when shutdown(wait=False), from           attempting to adjust the pools worker processes after           the object state has already been reset during shutdown.
          A combination of conditions, including a worker process           having terminated abormally, resulted in an exception and           a potential hang when the still-running executor thread           attempted to replace dead workers within the pool.
        - gh-130664: Support the '_' digit separator in formatting           of the integral part of Decimals. Patch by Sergey B           Kirpichev.
        - gh-85702: If zoneinfo._common.load_tzdata is given a           package without a resource a ZoneInfoNotFoundError is           raised rather than a IsADirectoryError.
        - gh-130664: Handle corner-case for Fractions formatting:
          treat zero-padding (preceding the width field by a zero           ('0') character) as an equivalent to a fill character of           '0' with an alignment type of '=', just as in case of           floats.
      * Tools/Demos
        - gh-135968: Stubs for strip are now provided as part of an           iOS install.
      * Tests
        - gh-135966: The iOS testbed now handles the app_packages           folder as a site directory.
        - gh-135494: Fix regrtest to support excluding tests from
          --pgo tests. Patch by Victor Stinner.
        - gh-135489: Show verbose output for failing tests during PGO           profiling step with enable-optimizations.
      * Documentation
        - gh-135171: Document that the iterator for the leftmost for           clause in the generator expression is created immediately.
      * Build
        - gh-135497: Fix the detection of MAXLOGNAME in the           configure.ac script.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

SUSE SLED15: libpython3_13-1_0 / python313 / python313-base / python313-curses / etc (SUSE-SU-2025:3706-1)

high Nessus Plugin ID 271166

Version 1.5

Version 1.4

Version 1.3

Version 1.2

Version 1.1

Version 1.5 Jun 26, 2026, 4:08 PM CVSS metrics ("CVSSv2 score" set to 6.5) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:L/Au:M/C:C/I:C/A:C") CVSSv2 severity (based on CVE-2025-8194, severity decreased from "High" to "Medium") Plugin metadata Plugin Feed: 202606261608
Version 1.4 May 1, 2026, 7:22 AM IAVM reference Plugin Feed: 202605010722
Version 1.3 Feb 25, 2026, 1:08 AM IAVM reference Plugin Feed: 202602250108
Version 1.2 Feb 14, 2026, 1:12 AM Plugin metadata (Add IAVM information) Plugin Feed: 202602140112
Version 1.1 Oct 22, 2025, 12:32 PM New Plugin Feed: 202510221232