Detections
Analytics
MiracleLinux 4 : [security - medium] python27 security, bug fix, and enhancement update (AXSA:2017-1647:01)
critical Nessus Plugin ID 289411
Synopsis
The remote MiracleLinux host is missing a security update.Description
The remote MiracleLinux 4 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2017-1647:01 advisory.python27-mod_wsgi The mod_wsgi adapter is an Apache module that provides a WSGI compliant interface for hosting Python based web applications within Apache. The adapter is written completely in C code against the Apache C runtime and for hosting WSGI applications within Apache has a lower overhead than using existing WSGI adapters for mod_python or CGI.
python27-python Python is an interpreted, interactive, object-oriented programming language often compared to Tcl, Perl, Scheme or Java. Python includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems (X11, Motif, Tk, Mac and MFC).
Programmers can write new built-in modules for Python in C or C .
Python can be used as an extension language for applications that need a programmable interface.
Note that documentation for Python is provided in the python-docs package.
This package provides the python executable; most of the actual implementation is within the python-libs package.
python27-python-coverage Coverage.py is a Python module that measures code coverage during Python execution. It uses the code analysis tools and tracing hooks provided in the Python standard library to determine which lines are executable, and which have been executed.
python27-python-pip Pip is a replacement for `easy_install <http://peak.telecommunity.com/DevCenter/EasyInstall>`_. It uses mostly the same techniques for finding packages, so packages that were made easy_installable should be pip-installable as well.
python27-python-setuptools Setuptools is a collection of enhancements to the Python distutils that allow you to more easily build and distribute Python packages, especially ones that have dependencies on other packages.
This package contains the runtime components of setuptools, necessary to execute the software that requires pkg_resources.py.
This package contains the distribute fork of setuptools.
python27-python-virtualenv virtualenv is a tool to create isolated Python environments. virtualenv is a successor to workingenv, and an extension of virtual-python. It is written by Ian Bicking, and sponsored by the Open Planning Project. It is licensed under an MIT-style permissive license.
Security issues fixed with this release:
CVE-2014-9365 The HTTP clients in the (1) httplib, (2) urllib, (3) urllib2, and (4) xmlrpclib libraries in CPython (aka Python) 2.x before 2.7.9 and 3.x before 3.4.3, when accessing an HTTPS URL, do not (a) check the certificate against a trust store or verify that the server hostname matches a domain name in the subject's (b) Common Name or (c) subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
Security Fix(es) in the python27-python component:
Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
Solution
Update the affected packages.See Also
Plugin Details
Severity: Critical
ID: 289411
File Name: miracle_linux_AXSA-2017-1647.nasl
Version: 1.1
Type: local
Published: 1/16/2026
Updated: 1/16/2026
Supported Sensors: Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Low
Score: 3.8
Vendor
Vendor Severity: Moderate
CVSS v2
Risk Factor: Medium
Base Score: 5.8
Temporal Score: 4.5
Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:N
CVSS Score Source: CVE-2014-9365
CVSS v3
Risk Factor: Critical
Base Score: 9.8
Temporal Score: 8.8
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C
Vulnerability Information
CPE: p-cpe:/a:miracle:linux:python27-python-test, p-cpe:/a:miracle:linux:python27-python-coverage, p-cpe:/a:miracle:linux:python27-python-libs, p-cpe:/a:miracle:linux:python27-python-devel, p-cpe:/a:miracle:linux:python27-python-pip, p-cpe:/a:miracle:linux:python27-mod_wsgi, cpe:/o:miracle:linux:4, p-cpe:/a:miracle:linux:python27-tkinter, p-cpe:/a:miracle:linux:python27-python-setuptools, p-cpe:/a:miracle:linux:python27-python, p-cpe:/a:miracle:linux:python27-python-tools, p-cpe:/a:miracle:linux:python27-python-debug
Required KB Items: Host/local_checks_enabled, Host/cpu, Host/MiracleLinux/release, Host/MiracleLinux/rpm-list
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 5/11/2017
Vulnerability Publication Date: 12/11/2014
Reference Information
CVE: CVE-2014-9365