According to the versions of the python packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in python. An improperly handled HTTP response in the HTTP client code of python may     allow a remote attacker, who controls the HTTP server, to make the client script enter an infinite loop,     consuming CPU time. The highest threat from this vulnerability is to system availability. (CVE-2021-3737)

  - There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP     server that an HTTP client (such as web browser) connects to, could trigger a Regular Expression Denial of     Service (ReDOS) during an authentication request with a specially crafted payload that is sent by the     server to the client. The greatest threat that this flaw poses is to application availability.
    (CVE-2021-3733)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the python3 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in python. An improperly handled HTTP response in the HTTP client code of python may     allow a remote attacker, who controls the HTTP server, to make the client script enter an infinite loop,     consuming CPU time. The highest threat from this vulnerability is to system availability. (CVE-2021-3737)

  - There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP     server that an HTTP client (such as web browser) connects to, could trigger a Regular Expression Denial of     Service (ReDOS) during an authentication request with a specially crafted payload that is sent by the     server to the client. The greatest threat that this flaw poses is to application availability.
    (CVE-2021-3733)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote SUSE Linux SLED12 / SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:3524-1 advisory.

  - There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP     server that an HTTP client (such as web browser) connects to, could trigger a Regular Expression Denial of     Service (ReDOS) during an authentication request with a specially crafted payload that is sent by the     server to the client. The greatest threat that this flaw poses is to application availability.
    (CVE-2021-3733)

  - A flaw was found in python. An improperly handled HTTP response in the HTTP client code of python may     allow a remote attacker, who controls the HTTP server, to make the client script enter an infinite loop,     consuming CPU time. The highest threat from this vulnerability is to system availability. (CVE-2021-3737)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the python3 package has been released.

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:4104-1 advisory.

  - There's a flaw in Python 3's pydoc. A local or adjacent attacker who discovers or is able to convince     another local or adjacent user to start a pydoc server could access the server and use it to disclose     sensitive information belonging to the other user that they would not normally be able to access. The     highest risk of this flaw is to data confidentiality. This flaw affects Python versions before 3.8.9,     Python versions before 3.9.3 and Python versions before 3.10.0a7. (CVE-2021-3426)

  - python: urllib: Regular expression DoS in AbstractBasicAuthHandler (CVE-2021-3733)

  - python: urllib: HTTP client possible infinite loop on a 100 Continue response (CVE-2021-3737)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:4104-1 advisory.

  - There's a flaw in Python 3's pydoc. A local or adjacent attacker who discovers or is able to convince     another local or adjacent user to start a pydoc server could access the server and use it to disclose     sensitive information belonging to the other user that they would not normally be able to access. The     highest risk of this flaw is to data confidentiality. This flaw affects Python versions before 3.8.9,     Python versions before 3.9.3 and Python versions before 3.10.0a7. (CVE-2021-3426)

  - There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP     server that an HTTP client (such as web browser) connects to, could trigger a Regular Expression Denial of     Service (ReDOS) during an authentication request with a specially crafted payload that is sent by the     server to the client. The greatest threat that this flaw poses is to application availability.
    (CVE-2021-3733)

  - A flaw was found in python. An improperly handled HTTP response in the HTTP client code of python may     allow a remote attacker, who controls the HTTP server, to make the client script enter an infinite loop,     consuming CPU time. The highest threat from this vulnerability is to system availability. (CVE-2021-3737)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:4015-2 advisory.

  - There's a flaw in Python 3's pydoc. A local or adjacent attacker who discovers or is able to convince     another local or adjacent user to start a pydoc server could access the server and use it to disclose     sensitive information belonging to the other user that they would not normally be able to access. The     highest risk of this flaw is to data confidentiality. This flaw affects Python versions before 3.8.9,     Python versions before 3.9.3 and Python versions before 3.10.0a7. (CVE-2021-3426)

  - There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP     server that an HTTP client (such as web browser) connects to, could trigger a Regular Expression Denial of     Service (ReDOS) during an authentication request with a specially crafted payload that is sent by the     server to the client. The greatest threat that this flaw poses is to application availability.
    (CVE-2021-3733)

  - A flaw was found in python. An improperly handled HTTP response in the HTTP client code of python may     allow a remote attacker, who controls the HTTP server, to make the client script enter an infinite loop,     consuming CPU time. The highest threat from this vulnerability is to system availability. (CVE-2021-3737)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3477 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-3477-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                          Adrian Bunk     June 30, 2023                                 https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : python3.7     Version        : 3.7.3-2+deb10u5     CVE ID         : CVE-2015-20107 CVE-2020-10735 CVE-2021-3426 CVE-2021-3733                      CVE-2021-3737 CVE-2021-4189 CVE-2022-45061

    Several vulnerabilities were fixed in the Python3 interpreter.

    CVE-2015-20107

        The mailcap module did not add escape characters into commands         discovered in the system mailcap file.

    CVE-2020-10735

        Prevent DoS with very large int.

    CVE-2021-3426

        Remove the pydoc getfile feature which could be abused to read         arbitrary files on the disk.

    CVE-2021-3733

        Regular Expression Denial of Service in urllib's AbstractBasicAuthHandler class.

    CVE-2021-3737

        Infinite loop in the HTTP client code.

    CVE-2021-4189

        Make ftplib not trust the PASV response.

    CVE-2022-45061

        Quadratic time in the IDNA decoder.

    For Debian 10 buster, these problems have been fixed in version     3.7.3-2+deb10u5.

    We recommend that you upgrade your python3.7 packages.

    For the detailed security status of python3.7 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/python3.7

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of IBM Cognos Analytics installed on the remote host is affected by multiple vulnerabilities, including the following:

  - OpenSSL is vulnerable to a buffer overflow, caused by improper bounds checking by the EVP_PKEY_decrypt()     function within implementation of the SM2 decryption. By sending specially crafted SM2 content, a remote     attacker could overflow a buffer and execute arbitrary code on the system or cause the application to     crash. (CVE-2021-3711)

  - Async could allow a remote attacker to execute arbitrary code on the system, caused by prototype pollution     in the mapValues() method. By persuading a victim to open a specially-crafted file, an attacker could     exploit this vulnerability to execute arbitrary code on the system.
    (CVE-2021-43138)

  - Apache Commons IO could allow a remote attacker to traverse directories on the system, caused by improper     input validation by the FileNameUtils.normalize method. An attacker could send a specially-crafted URL     request containing 'dot dot' sequences (/../) to view arbitrary files on the system.
    (CVE-2021-29425)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3980 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-3980-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                          Adrian Bunk     December 02, 2024                             https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : python3.9     Version        : 3.9.2-1+deb11u2     CVE ID         : CVE-2015-20107 CVE-2020-10735 CVE-2021-3426 CVE-2021-3733                      CVE-2021-3737 CVE-2021-4189 CVE-2021-28861 CVE-2021-29921                      CVE-2022-42919 CVE-2022-45061 CVE-2023-6597 CVE-2023-24329                      CVE-2023-27043 CVE-2023-40217 CVE-2024-0397 CVE-2024-0450                      CVE-2024-4032 CVE-2024-6232 CVE-2024-6923 CVE-2024-7592                      CVE-2024-8088 CVE-2024-9287 CVE-2024-11168     Debian Bug     : 989195 1070135 1059298 1070133

    Multiple vulnerabilities have been fixed in the Python3 interpreter.

    CVE-2015-20107

        The mailcap module did not add escape characters into commands         discovered in the system mailcap file

    CVE-2020-10735

        Prevent DoS with very large int

    CVE-2021-3426

        Remove the pydoc getfile feature which could be abused to read         arbitrary files on the disk

    CVE-2021-3733

        Regular Expression Denial of Service in urllib's         AbstractBasicAuthHandler class

    CVE-2021-3737

        Infinite loop in the HTTP client code

    CVE-2021-4189

        Make ftplib not trust the PASV response

    CVE-2021-28861

        Open redirection vulnerability in http.server

    CVE-2021-29921

        Leading zeros in IPv4 addresses are no longer tolerated

    CVE-2022-42919

        Don't use Linux abstract sockets for multiprocessing

    CVE-2022-45061

        Quadratic time in the IDNA decoder

    CVE-2023-6597

        tempfile.TemporaryDirectory failure to remove dir

    CVE-2023-24329

        Strip C0 control and space chars in urlsplit

    CVE-2023-27043

        Reject malformed addresses in email.parseaddr()

    CVE-2023-40217

        ssl.SSLSocket bypass of the TLS handshake

    CVE-2024-0397

        Race condition in ssl.SSLContext

    CVE-2024-0450

        Quoted-overlap zipbomb DoS

    CVE-2024-4032

        Incorrect information about private addresses in the ipaddress         module

    CVE-2024-6232

        ReDoS when parsing tarfile headers

    CVE-2024-6923

        Encode newlines in headers in the email module

    CVE-2024-7592

        Quadratic complexity parsing cookies with backslashes

    CVE-2024-8088

        Infinite loop when iterating over zip archive entry names

    CVE-2024-9287

        venv activation scripts did't quote paths

    CVE-2024-11168

        urllib functions improperly validated bracketed hosts

    For Debian 11 bullseye, these problems have been fixed in version     3.9.2-1+deb11u2.

    We recommend that you upgrade your python3.9 packages.

    For the detailed security status of python3.9 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/python3.9

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
158303	EulerOS 2.0 SP3 : python (EulerOS-SA-2022-1183)	Nessus	Huawei Local Security Checks	2/23/2022	11/7/2023	high
158385	EulerOS 2.0 SP10 : python3 (EulerOS-SA-2022-1233)	Nessus	Huawei Local Security Checks	2/25/2022	11/7/2023	high
154637	SUSE SLED12 / SLES12 Security Update : python (SUSE-SU-2021:3524-1)	Nessus	SuSE Local Security Checks	10/28/2021	7/13/2023	high
203910	Photon OS 3.0: Python3 PHSA-2022-3.0-0433	Nessus	PhotonOS Local Security Checks	7/24/2024	7/24/2024	medium
156140	openSUSE 15 Security Update : python3 (openSUSE-SU-2021:4104-1)	Nessus	SuSE Local Security Checks	12/17/2021	11/22/2023	medium
156148	SUSE SLED15 / SLES15 Security Update : python3 (SUSE-SU-2021:4104-1)	Nessus	SuSE Local Security Checks	12/17/2021	7/14/2023	medium
156282	SUSE SLES15 Security Update : python3 (SUSE-SU-2021:4015-2)	Nessus	SuSE Local Security Checks	12/25/2021	7/14/2023	medium
177875	Debian dla-3477 : idle-python3.7 - security update	Nessus	Debian Local Security Checks	7/1/2023	1/22/2025	high
166606	IBM Cognos Analytics Multiple Vulnerabilities (6828527)	Nessus	CGI abuses	10/27/2022	1/5/2023	critical
211991	Debian dla-3980 : idle-python3.9 - security update	Nessus	Debian Local Security Checks	12/2/2024	12/2/2024	critical

Detections

Analytics

Plugins Search

high

high

high

medium

medium

medium

medium

high

critical

critical