The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2019-4284:05 advisory.

    * python: Missing salt initialization in _elementtree.c module (CVE-2018-14647)
      * python: NULL pointer dereference using a specially crafted X509 certificate (CVE-2019-5010)
      * python: CRLF injection via the query part of the url passed to urlopen() (CVE-2019-9740)
      * python: CRLF injection via the path part of the url passed to urlopen() (CVE-2019-9947)
      * python: Undocumented local_file protocol allows remote attackers to bypass protection mechanisms     (CVE-2019-9948)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AOS installed on the remote host is prior to 5.10.9. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-5.10.9 advisory.

  - Gnome Pango 1.42 and later is affected by: Buffer Overflow. The impact is: The heap based buffer overflow     can be used to get code execution. The component is: function name: pango_log2vis_get_embedding_levels,     assignment of nchars and the loop condition. The attack vector is: Bug can be used when application pass     invalid utf-8 strings to functions like pango_itemize. (CVE-2019-1010238)

  - curl before version 7.61.1 is vulnerable to a buffer overrun in the NTLM authentication code. The internal     function Curl_ntlm_core_mk_nt_hash multiplies the length of the password by two (SUM) to figure out how     large temporary storage area to allocate from the heap. The length value is then subsequently used to     iterate over the password and generate output into the allocated storage buffer. On systems with a 32 bit     size_t, the math to calculate SUM triggers an integer overflow when the password length exceeds 2GB (2^31     bytes). This integer overflow usually causes a very small buffer to actually get allocated instead of the     intended very huge one, making the use of that buffer end up in a heap buffer overflow. (This bug is     almost identical to CVE-2017-8816.) (CVE-2018-14618)

  - An issue was discovered in XListExtensions in ListExt.c in libX11 through 1.6.5. A malicious server can     send a reply in which the first string overflows, causing a variable to be set to NULL that will be freed     later on, leading to DoS (segmentation fault). (CVE-2018-14598)

  - An issue was discovered in libX11 through 1.6.5. The function XListExtensions in ListExt.c is vulnerable     to an off-by-one error caused by malicious server responses, leading to DoS or possibly unspecified other     impact. (CVE-2018-14599)

  - An issue was discovered in libX11 through 1.6.5. The function XListExtensions in ListExt.c interprets a     variable as signed instead of unsigned, resulting in an out-of-bounds write (of up to 128 bytes), leading     to DoS or remote code execution. (CVE-2018-14600)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The update issued as DLA-1835-1 caused a regression in the http.client library in Python 3.4 which was broken by the patch intended to fix CVE-2019-9740 and CVE-2019-9947.

For Debian 8 'Jessie', this problem has been fixed in version 3.4.2-1+deb8u4.

We recommend that you upgrade your python3.4 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2019:3335 advisory.

  - python-urllib3: CRLF injection due to not encoding the '\r\n' sequence leading to possible attack on     internal service (CVE-2019-11236)

  - python-urllib3: Certification mishandle when error should be thrown (CVE-2019-11324)

  - numpy: crafted serialized object passed in numpy.load() in pickle python module allows arbitrary code     execution (CVE-2019-6446)

  - python: CRLF injection via the query part of the url passed to urlopen() (CVE-2019-9740)

  - python: CRLF injection via the path part of the url passed to urlopen() (CVE-2019-9947)

  - python: Undocumented local_file protocol allows remote attackers to bypass protection mechanisms     (CVE-2019-9948)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for python36 to version 3.6.10 fixes the following issues :

CVE-2017-18207: Fixed a denial of service in Wave_read._read_fmt_chunk() (bsc#1083507).

CVE-2019-16056: Fixed an issue where email parsing could fail for multiple @ signs (bsc#1149955).

CVE-2019-15903: Fixed a heap-based buffer over-read in libexpat (bsc#1149429).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security fix for CVE-2019-9740 and CVE-2019-9947. Fix a regression introduced by the fix for CVE-2019-9636. Add manual page link for python3.7m.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the python2 package has been released.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3.
    CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument     to urllib.request.urlopen with \r\n (specifically in the path component of a URL that lacks a ? character)     followed by an HTTP header or a Redis command. This is similar to the CVE-2019-9740 query string issue.
    This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.8, v3.5.8rc1,     v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.4,     v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9.
    (CVE-2019-9947)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2021:0080 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2019-10160:
    A security regression of CVE-2019-9636 was discovered in python since commit     d537ab0ff9767ef024f26246899728f0116b1ec3 affecting versions 2.7, 3.5, 3.6, 3.7 and from v3.8.0a4 through     v3.8.0b1, which still allows an attacker to exploit CVE-2019-9636 by abusing the user and password parts     of a URL. When an application parses user-supplied URLs to store cookies, authentication credentials, or     other kind of information, it is possible for an attacker to provide specially crafted URLs to make the     application locate host-related information (e.g. cookies, authentication data) and send them to a     different host than where it should, unlike if the URLs had been correctly parsed. The result of an attack     may vary based on the application.

    CVE-2019-16056:
    An issue was discovered in Python through 2.7.16, 3.x through 3.5.7, 3.6.x through 3.6.9, and 3.7.x     through 3.7.4. The email module wrongly parses email addresses that contain multiple @ characters. An     application that uses the email module and implements some kind of checks on the From/To headers of a     message could be tricked into accepting an email address that should be denied. An attack may be the same     as in CVE-2019-11340; however, this CVE applies to Python more generally.

    CVE-2019-16935:
    The documentation XML-RPC server in Python through 2.7.16, 3.x through 3.6.9, and 3.7.x through 3.7.4 has     XSS via the server_title field. This occurs in Lib/DocXMLRPCServer.py in Python 2.x, and in     Lib/xmlrpc/server.py in Python 3.x. If set_server_title is called with untrusted input, arbitrary     JavaScript can be delivered to clients that visit the http URL for this server.

    CVE-2019-20907:
    In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an     infinite loop when opened by tarfile.open, because _proc_pax lacks header validation.

    CVE-2019-5010:
    An exploitable denial-of-service vulnerability exists in the X509 certificate parser of Python.org Python     2.7.11 / 3.6.6. A specially crafted X509 certificate can cause a NULL pointer dereference, resulting in a     denial of service. An attacker can initiate or accept TLS connections using crafted certificates to     trigger this vulnerability.

    CVE-2019-9636:
    Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode Encoding     (with an incorrect netloc) during NFKC normalization. The impact is: Information disclosure (credentials,     cookies, etc. that are cached against a given hostname). The components are: urllib.parse.urlsplit,     urllib.parse.urlparse. The attack vector is: A specially crafted URL could be incorrectly parsed to locate     cookies or authentication data and send that information to a different host than when parsed correctly.
    This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.7, v3.5.8,     v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1;
    v3.7.3, v3.7.3rc1, v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1,     v3.7.8, v3.7.8rc1, v3.7.9.

    CVE-2019-9947:
    An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3.
    CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument     to urllib.request.urlopen with \r\n (specifically in the path component of a URL that lacks a ? character)     followed by an HTTP header or a Redis command. This is similar to the CVE-2019-9740 query string issue.
    This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.8, v3.5.8rc1,     v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.4,     v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9.

    CVE-2019-9948:
    urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote     attackers to bypass protection mechanisms that blacklist file: URIs, as demonstrated by triggering a     urllib.urlopen('local_file:///etc/passwd') call.

    CVE-2020-14422:
    Lib/ipaddress.py in Python through 3.8.3 improperly computes hash values in the IPv4Interface and     IPv6Interface classes, which might allow a remote attacker to cause a denial of service if an application     is affected by the performance of a dictionary containing IPv4Interface or IPv6Interface objects, and this     attacker can cause many dictionary entries to be created. This is fixed in: v3.5.10, v3.5.10rc1; v3.6.12;
    v3.7.9; v3.8.4, v3.8.4rc1, v3.8.5, v3.8.6, v3.8.6rc1; v3.9.0, v3.9.0b4, v3.9.0b5, v3.9.0rc1, v3.9.0rc2.

    CVE-2020-26116:
    http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5     allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR     and LF control characters in the first argument of HTTPConnection.request.

    CVE-2020-27619:
    In Python 3 through 3.9.0, the Lib/test/multibytecodec_support.py CJK codec tests call eval() on content     retrieved via HTTP.

    CVE-2020-8492:
    Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1     allows an HTTP server to conduct Regular Expression Denial of Service (ReDoS) attacks against a client     because of urllib.request.AbstractBasicAuthHandler catastrophic backtracking.

    CVE-2021-23336:
    The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before     3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to Web Cache Poisoning via urllib.parse.parse_qsl and     urllib.parse.parse_qs by using a vector called parameter cloaking. When the attacker can separate query     parameters using a semicolon (;), they can cause a difference in the interpretation of the request between     the proxy (running with default configuration) and the server. This can result in malicious requests being     cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and     therefore would not include it in a cache key of an unkeyed parameter.

    CVE-2021-3177:
    Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to     remote code execution in certain Python applications that accept floating-point numbers as untrusted     input, as demonstrated by a 1e300 argument to c_double.from_param. This occurs because sprintf is used     unsafely.

    CVE-2021-3733:
    ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when     announcing a new security problem. When the candidate has been publicized, the details for this candidate     will be provided.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the python packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The documentation XML-RPC server in Python through     2.7.16, 3.x through 3.6.9, and 3.7.x through 3.7.4 has     XSS via the server_title field. This occurs in     Lib/DocXMLRPCServer.py in Python 2.x, and in     Lib/xmlrpc/server.py in Python 3.x. If set_server_title     is called with untrusted input, arbitrary JavaScript     can be delivered to clients that visit the http URL for     this server.(CVE-2019-16935)

  - library/glob.html in the Python 2 and 3 documentation     before 2016 has potentially misleading information     about whether sorting occurs, as demonstrated by     irreproducible cancer-research results. NOTE: the     effects of this documentation cross application     domains, and thus it is likely that security-relevant     code elsewhere is affected. This issue is not a Python     implementation bug, and there are no reports that NMR     researchers were specifically relying on     library/glob.html. In other words, because the older     documentation stated 'finds all the pathnames matching     a specified pattern according to the rules used by the     Unix shell,' one might have incorrectly inferred that     the sorting that occurs in a Unix shell also occurred     for glob.glob. There is a workaround in newer versions     of Willoughby nmr-data_compilation-p2.py and     nmr-data_compilation-p3.py, which call sort()     directly.(CVE-2019-17514)

  - An issue was discovered in Python through 2.7.16, 3.x     through 3.5.7, 3.6.x through 3.6.9, and 3.7.x through     3.7.4. The email module wrongly parses email addresses     that contain multiple @ characters. An application that     uses the email module and implements some kind of     checks on the From/To headers of a message could be     tricked into accepting an email address that should be     denied. An attack may be the same as in CVE-2019-11340     however, this CVE applies to Python more     generally.(CVE-2019-16056)

  - http.cookiejar.DefaultPolicy.domain_return_ok in     Lib/http/cookiejar.py in Python before 3.7.3 does not     correctly validate the domain: it can be tricked into     sending existing cookies to the wrong server. An     attacker may abuse this flaw by using a server with a     hostname that has another valid hostname as a suffix     (e.g., pythonicexample.com to steal cookies for     example.com). When a program uses     http.cookiejar.DefaultPolicy and tries to do an HTTP     connection to an attacker-controlled server, existing     cookies can be leaked to the attacker. This affects 2.x     through 2.7.16, 3.x before 3.4.10, 3.5.x before 3.5.7,     3.6.x before 3.6.9, and 3.7.x before     3.7.3.(CVE-2018-20852)

  - An issue was discovered in urllib2 in Python 2.x     through 2.7.16 and urllib in Python 3.x through 3.7.3.
    CRLF injection is possible if the attacker controls a     url parameter, as demonstrated by the first argument to     urllib.request.urlopen with \r\n (specifically in the     query string after a ? character) followed by an HTTP     header or a Redis command.(CVE-2019-9740)

  - An issue was discovered in urllib2 in Python 2.x     through 2.7.16 and urllib in Python 3.x through 3.7.3.
    CRLF injection is possible if the attacker controls a     url parameter, as demonstrated by the first argument to     urllib.request.urlopen with \r\n (specifically in the     path component of a URL that lacks a ? character)     followed by an HTTP header or a Redis command. This is     similar to the CVE-2019-9740 query string     issue.(CVE-2019-9947)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the python3 package has been released.

This update for python fixes the following issues :

Security issues fixed :

  - CVE-2019-9947: Fixed an insufficient validation of URL     paths with embedded whitespace or control characters     that could allow HTTP header injections. (bsc#1130840)

  - CVE-2019-16056: Fixed a parser issue in the email     module. (bsc#1149955)

  - CVE-2019-16935: Fixed a reflected XSS in     python/Lib/DocXMLRPCServer.py (bsc#1153238).

This update was imported from the SUSE:SLE-15:Update update project.

ID	Name	Product	Family	Published	Updated	Severity
289185	MiracleLinux 7 : python-2.7.5-86.0.1.el7.AXS7 (AXSA:2019-4284:05)	Nessus	Miracle Linux Local Security Checks	1/16/2026	1/16/2026	critical
164581	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.10.9)	Nessus	Misc.	9/1/2022	7/22/2025	critical
126223	Debian DLA-1835-2 : python3.4 regression update	Nessus	Debian Local Security Checks	6/25/2019	5/14/2024	medium
145618	CentOS 8 : python27:2.7 (CESA-2019:3335)	Nessus	CentOS Local Security Checks	1/29/2021	1/25/2024	critical
133448	SUSE SLES12 Security Update : python36 (SUSE-SU-2020:0302-1)	Nessus	SuSE Local Security Checks	2/4/2020	3/28/2024	critical
125434	Fedora 29 : python3 (2019-ec26883852)	Nessus	Fedora Local Security Checks	5/28/2019	5/20/2024	critical
202770	Photon OS 3.0: Python2 PHSA-2019-3.0-0016	Nessus	PhotonOS Local Security Checks	7/22/2024	7/24/2024	medium
223081	Linux Distros Unpatched Vulnerability : CVE-2019-9947	Nessus	Misc.	3/4/2025	8/20/2025	medium
236495	Alibaba Cloud Linux 3 : 0080: python3 (ALINUX3-SA-2021:0080)	Nessus	Alibaba Cloud Linux Local Security Checks	5/14/2025	5/14/2025	critical
130687	EulerOS 2.0 SP5 : python (EulerOS-SA-2019-2225)	Nessus	Huawei Local Security Checks	11/8/2019	4/15/2024	high
126123	Photon OS 1.0: Python2 PHSA-2019-1.0-0236	Nessus	PhotonOS Local Security Checks	6/24/2019	5/15/2024	medium
126201	Photon OS 1.0: Python3 PHSA-2019-1.0-0237	Nessus	PhotonOS Local Security Checks	6/25/2019	5/14/2024	medium
130337	openSUSE Security Update : python (openSUSE-2019-2389)	Nessus	SuSE Local Security Checks	10/28/2019	4/16/2024	high

Detections

Analytics

Plugins Search

critical

critical

medium

critical

critical

critical

medium

medium

critical

high

medium

medium

high