The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1107-1 advisory.

    Update to Python 3.12.13:

    - CVE-2025-6075: quadratic complexity in os.path.expandvars() (bsc#1252974).
    - CVE-2025-11468: header injection with carefully crafted inputs (bsc#1257029).
    - CVE-2025-12084: quadratic complexity in xml.minidom node ID cache clearing (bsc#1254997).
    - CVE-2025-13836: potential memory denial of service in the http.client module (bsc#1254400).
    - CVE-2025-13837: potential memory denial of service in the plistlib module (bsc#1254401).
    - CVE-2025-15282: user-controlled data URLs parsed may allow injecting headers (bsc#1257046).
    - CVE-2026-0672: control characters in http.cookies.Morsel fields and values (bsc#1257031).
    - CVE-2026-0865: C0 control characters within wsgiref.headers.Headers fields, values, and parameters     (bsc#1257042).
    - CVE-2026-1299: header injection when an email is serialized due to improper newline quoting     (bsc#1257181).
    - CVE-2026-2297: validation bypass via incorrectly handled hook in FileLoader (bsc#1259240).

    Changelog:
     - gh-144125: BytesGenerator will now refuse to serialize      (write) headers that are unsafely folded or delimited; see      verify_generated_headers. (Contributed by Bas Bloemsaat and      Petr Viktorin in gh-121650) (bsc#1257181, CVE-2026-1299).
     - gh-143935: Fixed a bug in the folding of comments when      flattening an email message using a modern email policy.
     Comments consisting of a very long sequence of non-foldable      characters could trigger a forced line wrap that omitted      the required leading space on the continuation line,      causing the remainder of the comment to be interpreted as      a new header field. This enabled header injection with      carefully crafted inputs (bsc#1257029 CVE-2025-11468).
     - gh-143925: Reject control characters in data: URL media      types (bsc#1257046, CVE-2025-15282).
     - gh-143919: Reject control characters in http.cookies.Morsel      fields and values (bsc#1257031, CVE-2026-0672).
     - gh-143916: Reject C0 control characters within      wsgiref.headers.Headers fields, values, and parameters      (bsc#1257042, CVE-2026-0865).
     - gh-142145: Remove quadratic behavior in xml.minidom node ID      cache clearing. In order to do this without breaking      existing users, we also add the ownerDocument attribute to      xml.dom.minidom elements and attributes created by directly      instantiating the Element or Attr class. Note that this way      of creating nodes is not supported; creator functions like      xml.dom.Document.documentElement() should be used instead      (bsc#1254997, CVE-2025-12084).
     - gh-137836: Add support of the 'plaintext' element, RAWTEXT      elements 'xmp', 'iframe', 'noembed' and 'noframes', and      optionally RAWTEXT element 'noscript' in      html.parser.HTMLParser.
     - gh-136063: email.message: ensure linear complexity for      legacy HTTP parameters parsing. Patch by Benedikt Tran.
     - gh-136065: Fix quadratic complexity in      os.path.expandvars() (bsc#1252974, CVE-2025-6075).
     - gh-119451: Fix a potential memory denial of service in the      http.client module. When connecting to a malicious server,      it could cause an arbitrary amount of memory to be      allocated. This could have led to symptoms including      a MemoryError, swapping, out of memory (OOM) killed      processes or containers, or even system crashes      (CVE-2025-13836, bsc#1254400).
     - gh-119452: Fix a potential memory denial of service in the      http.server module. When a malicious user is connected to      the CGI server on Windows, it could cause an arbitrary      amount of memory to be allocated. This could have led to      symptoms including a MemoryError, swapping, out of memory      (OOM) killed processes or containers, or even system      crashes.
     - gh-119342: Fix a potential memory denial of service in the      plistlib module. When reading a Plist file received from      untrusted source, it could cause an arbitrary amount of      memory to be allocated. This could have led to symptoms      including a MemoryError, swapping, out of memory (OOM)      killed processes or containers, or even system crashes      (bsc#1254401, CVE-2025-13837).
     - Library
     - gh-144833: Fixed a use-after-free in ssl when SSL_new()      returns NULL in newPySSLSocket(). The error was reported      via a dangling pointer after the object had already been      freed.
     - gh-144363: Update bundled libexpat to 2.7.4
     - gh-90949: Add SetAllocTrackerActivationThreshold() and      SetAllocTrackerMaximumAmplification() to xmlparser objects      to prevent use of disproportional amounts of dynamic memory      from within an Expat parser. Patch by Benedikt Tran.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

SUSE SLES15: libpython3_12-1_0 / python312 / python312-base / python312-curses / etc (SUSE-SU-2026:1107-1)

medium Nessus Plugin ID 304121

Version 1.4

Version 1.3

Version 1.2

Version 1.1

Version 1.4 Sep 23, 2026, 1:21 PM Detection (updated detection logic) Plugin Feed: 202609231321
Version 1.3 Sep 18, 2026, 2:17 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202609181417
Version 1.2 May 1, 2026, 7:22 AM IAVM reference Plugin Feed: 202605010722
Version 1.1 Mar 28, 2026, 12:01 PM New Plugin Feed: 202603281201