Detections
Analytics

Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS : Python vulnerabilities (USN-8509-1)

critical Nessus Plugin ID 325428

Synopsis

The remote Ubuntu host is missing one or more security updates.

Description

The remote Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8509-1 advisory.

 It was discovered that Python incorrectly normalized paths in the tarfile module. An attacker could possibly use this issue to bypass path restrictions. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2025-13462)

 It was discovered that Python's HTMLParser incorrectly handled certain malformed HTML input. An attacker could possibly use this issue to cause Python to crash, resulting in a denial of service. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2025-69534)

 It was discovered that Python's email module incorrectly quoted newlines in headers. An attacker could possibly use this issue to inject arbitrary email headers. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-1299)

 It was discovered that Python's http.client module did not properly sanitize carriage return and linefeed characters when handling HTTP CONNECT tunnel request headers. An attacker could possibly use this issue to inject arbitrary HTTP headers. (CVE-2026-1502)

 It was discovered that Python's importlib module did not generate an audit event when loading legacy .pyc files. An attacker could possibly use this issue to bypass auditing mechanisms. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-2297)

 It was discovered that Python's unicodedata.normalize() function had incorrect algorithmic complexity. An attacker could possibly use this issue to cause Python to consume excessive resources, leading to a denial of service. (CVE-2026-3276)

 It was discovered that Python's http.cookies module incorrectly handled control characters in certain cookie operations. An attacker could possibly use this issue to inject arbitrary content. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-3644)

 It was discovered that the Python pyexpat module was vulnerable to unbounded recursion in the Expat XML parser. An attacker could possibly use this issue to cause Python to crash, resulting in a denial of service. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-4224)

 It was discovered that Python's webbrowser module accepted leading dashes in URLs, which could be interpreted as command-line options. An attacker could possibly use this issue to execute arbitrary commands. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-4519)

 It was discovered that Python incorrectly handled webbrowser.open() handlers. An attacker could possibly use this issue to execute arbitrary commands. (CVE-2026-4786)

 It was discovered that Python's remote debugging module did not properly validate offset tables when loading debug information. An attacker could possibly use this issue to cause Python to crash or execute arbitrary code. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-5713)

 It was discovered that Python's http.cookies module incorrectly escaped values in the js_output() method.
 An attacker could possibly use this issue to inject arbitrary JavaScript. (CVE-2026-6019)

 It was discovered that Python's lzma, bz2, and gzip decompressor objects had a use-after-free vulnerability. An attacker could possibly use this issue to cause Python to crash or execute arbitrary code. (CVE-2026-6100)

 It was discovered that Python's tarfile module did not properly validate link targets when using the data filter. An attacker could possibly use this issue to bypass path restrictions. This issue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-7774)

 It was discovered that the fix for CVE-2021-4189 in Python's ftplib module was incomplete, allowing PASV responses to be used in ftplib.ftpcp(). An attacker could possibly use this issue to perform server-side request forgery attacks. (CVE-2026-8328)

 It was discovered that Python's bz2 module allowed reuse of a BZ2Decompressor object after a decompression error. An attacker could possibly use this issue to cause Python to crash or execute arbitrary code.
 (CVE-2026-9669)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected packages.

See Also

https://ubuntu.com/security/notices/USN-8509-1

Plugin Details

Severity: Critical

ID: 325428

File Name: ubuntu_USN-8509-1.nasl

Version: 1.1

Type: Local

Agent: unix

Published: 7/7/2026

Updated: 7/7/2026

Supported Sensors: Agentless Assessment, Continuous Assessment, Frictionless Assessment Agent, Frictionless Assessment AWS, Frictionless Assessment Azure, Nessus Agent, Tenable Cloud Security, Tenable Self-Hosted Container Security, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 57.95

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 6.1

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:C/A:N

CVSS Score Source: CVE-2026-3644

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.7

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

CVSS v4

Risk Factor: Critical

Base Score: 9.1

Threat Score: 8.1

Threat Vector: CVSS:4.0/E:P

Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

CVSS Score Source: CVE-2026-6100

Vulnerability Information

CPE: p-cpe:/a:canonical:ubuntu_linux:python3.14-gdbm, cpe:/o:canonical:ubuntu_linux:24.04:-:lts, p-cpe:/a:canonical:ubuntu_linux:libpython3.14-stdlib, p-cpe:/a:canonical:ubuntu_linux:libpython3.14-testsuite, p-cpe:/a:canonical:ubuntu_linux:idle-python3.10, p-cpe:/a:canonical:ubuntu_linux:libpython3.12-stdlib, p-cpe:/a:canonical:ubuntu_linux:python3.14-nopie, p-cpe:/a:canonical:ubuntu_linux:python3.10, p-cpe:/a:canonical:ubuntu_linux:python3.10-examples, p-cpe:/a:canonical:ubuntu_linux:python3.14-venv, p-cpe:/a:canonical:ubuntu_linux:python3.14, p-cpe:/a:canonical:ubuntu_linux:python3.14-dev, p-cpe:/a:canonical:ubuntu_linux:python3.10-minimal, p-cpe:/a:canonical:ubuntu_linux:python3.12-full, p-cpe:/a:canonical:ubuntu_linux:python3.12, p-cpe:/a:canonical:ubuntu_linux:libpython3.12-testsuite, p-cpe:/a:canonical:ubuntu_linux:libpython3.12-dev, p-cpe:/a:canonical:ubuntu_linux:python3.10-nopie, p-cpe:/a:canonical:ubuntu_linux:libpython3.10-stdlib, p-cpe:/a:canonical:ubuntu_linux:python3.12-nopie, p-cpe:/a:canonical:ubuntu_linux:python3.12-venv, p-cpe:/a:canonical:ubuntu_linux:libpython3.10-dev, p-cpe:/a:canonical:ubuntu_linux:libpython3.10-minimal, p-cpe:/a:canonical:ubuntu_linux:python3.10-dev, p-cpe:/a:canonical:ubuntu_linux:libpython3.10, p-cpe:/a:canonical:ubuntu_linux:python3.14-minimal, p-cpe:/a:canonical:ubuntu_linux:python3.10-full, p-cpe:/a:canonical:ubuntu_linux:python3.14-examples, p-cpe:/a:canonical:ubuntu_linux:libpython3.12-minimal, p-cpe:/a:canonical:ubuntu_linux:python3.14-tk, p-cpe:/a:canonical:ubuntu_linux:python3.10-venv, p-cpe:/a:canonical:ubuntu_linux:python3.14-full, p-cpe:/a:canonical:ubuntu_linux:idle-python3.12, p-cpe:/a:canonical:ubuntu_linux:libpython3.14, p-cpe:/a:canonical:ubuntu_linux:idle-python3.14, cpe:/o:canonical:ubuntu_linux:26.04:-:lts, p-cpe:/a:canonical:ubuntu_linux:python3.12-dev, p-cpe:/a:canonical:ubuntu_linux:libpython3.10-testsuite, p-cpe:/a:canonical:ubuntu_linux:python3.12-minimal, p-cpe:/a:canonical:ubuntu_linux:python3.12-examples, cpe:/o:canonical:ubuntu_linux:22.04:-:lts, p-cpe:/a:canonical:ubuntu_linux:libpython3.12t64, p-cpe:/a:canonical:ubuntu_linux:libpython3.14-dev, p-cpe:/a:canonical:ubuntu_linux:libpython3.14-minimal

Required KB Items: Host/cpu, Host/Ubuntu, Host/Ubuntu/release, Host/Debian/dpkg-l

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 7/6/2026

Vulnerability Publication Date: 2/16/2022

Reference Information

CVE: CVE-2021-4189, CVE-2025-13462, CVE-2025-69534, CVE-2026-0672, CVE-2026-1299, CVE-2026-1502, CVE-2026-2297, CVE-2026-3276, CVE-2026-3644, CVE-2026-4224, CVE-2026-4519, CVE-2026-4786, CVE-2026-5713, CVE-2026-6019, CVE-2026-6100, CVE-2026-7774, CVE-2026-8328, CVE-2026-9669

USN: 8509-1