Detections
Analytics
EulerOS 2.0 SP13 : python-pip (EulerOS-SA-2026-2993)
high Nessus Plugin ID 332867
Synopsis
The remote EulerOS host is missing multiple security updates.Description
According to the versions of the python-pip packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :pip would treat console_scripts and gui_scripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry points being installed outside the installation directory.(CVE-2026-8643)
pip handles concatenated tar and ZIP files as ZIP files regardless of filename or whether a file is both a tar and ZIP file. This behavior could result in confusing installation behavior, such as installing 'incorrect' files according to the filename of the archive. New behavior only proceeds with installation if the file identifies uniquely as a ZIP or tar archive, not as both.(CVE-2026-3219)
urllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin redirects followed from the low-level API via ProxyManager.connection_from_url().urlopen(..., assert_same_host=False) still forward these sensitive headers. This vulnerability is fixed in 2.7.0.(CVE-2026-44431)
Tenable has extracted the preceding description block directly from the EulerOS python-pip security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Update the affected python-pip packages.See Also
Plugin Details
Severity: High
ID: 332867
File Name: EulerOS_SA-2026-2993.nasl
Version: 1.1
Type: Local
Family: Huawei Local Security Checks
Published: 8/6/2026
Updated: 8/6/2026
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Low
Score: 3.2
Percentile: 51.04
CVSS v2
Risk Factor: Medium
Base Score: 5
Temporal Score: 3.7
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N
CVSS Score Source: CVE-2026-44431
CVSS v3
Risk Factor: Medium
Base Score: 5.5
Temporal Score: 4.8
Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
CVSS Score Source: CVE-2026-8643
CVSS v4
Risk Factor: High
Base Score: 8.2
Threat Score: 4.6
Threat Vector: CVSS:4.0/E:U
Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Vulnerability Information
CPE: cpe:/o:huawei:euleros:2.0, p-cpe:/a:huawei:euleros:python-pip-help, p-cpe:/a:huawei:euleros:python-pip-wheel, p-cpe:/a:huawei:euleros:python3-pip
Required KB Items: Host/local_checks_enabled, Host/cpu, Host/EulerOS/release, Host/EulerOS/rpm-list, Host/EulerOS/sp
Excluded KB Items: Host/EulerOS/uvp_version
Exploit Ease: No known exploits are available
Patch Publication Date: 8/6/2026
Vulnerability Publication Date: 4/20/2026