The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3601-1 advisory.

    - CVE-2026-0864: improper handling of line-ending characters can lead to configuration file injection when     the       `configparser` module is used (bsc#1269066).
    - CVE-2026-1703: files may be extracted outside the installation directory when installing and extracting     maliciously       crafted wheel archives (bsc#1257599).
    - CVE-2026-3219: python-pip: pip doesn't reject concatenated ZIP (bsc#1262467).
    - CVE-2026-3276: quadratic complexity in `unicodedata.normalize()` can lead to DoS when processing     specially crafted       Unicode input (bsc#1267581).
    - CVE-2026-4360: in the Tarfile.extract() function, the filter parameter is not passed properly when     extracting       hardlinks (bsc#1269959).
    - CVE-2026-6357: pip self-update functionality can import newly installed modules after wheel installation     (bsc#1263442,       bsc#1263443).
    - CVE-2026-7774: `tarfile.data_filter` path traversal bypass allows writing outside the extraction     directory       (bsc#1267821).
    - CVE-2026-8643: Path traversal via malicious entry point name in pip wheel installation allows arbitrary     file overwrite       (bsc#1266669).
    - CVE-2026-11972: infinite loop due to improper EOF handling in the tarfile module streaming mode can lead     to DoS       (bsc#1269788).
    - CVE-2026-15308: Incremental HTMLParser allows CPU-exhaustion DoS via repeated unterminated markup     declarations       (bsc#1271192).
    - Fix for CVE-2026-6019 does not handle non-ascii chars correctly. Regression in `http.cookies`     (bsc#1263083).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

SUSE SLES12: libpython3_4m1_0 / libpython3_4m1_0-32bit / python3 / python3-base / etc (SUSE-SU-2026:3601-1)

high Nessus Plugin ID 335093

Version 1.2

Version 1.1

Version 1.2 Sep 3, 2026, 1:08 PM CVSS metrics ("Cvssv4 supplemental" set to "CVSS:4.0/U:Amber") Plugin Feed: 202609031308
Version 1.1 Aug 13, 2026, 3:17 PM New Plugin Feed: 202608131517