The remote Ubuntu 20.04 LTS / 22.04 LTS / 23.04 / 23.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6539-1 advisory.

    It was discovered that the python-cryptography Cipher.update_into function would incorrectly accept     objects with immutable buffers. This would result in corrupted output, contrary to expectations. This     issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 23.04. (CVE-2023-23931)

    It was dicovered that python-cryptography incorrectly handled loading certain PKCS7 certificates. A remote     attacker could possibly use this issue to cause python-cryptography to crash, resulting in a denial of     service. This issue only affected Ubuntu 22.04 LTS, Ubuntu 23.04, and Ubuntu 23.10. (CVE-2023-49083)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the python-cryptography packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In     affected versions `Cipher.update_into` would accept Python objects which implement the buffer protocol,     but provide only immutable buffers. This would allow immutable objects (such as `bytes`) to be mutated,     thus violating fundamental rules of Python and resulting in corrupted output. This now correctly raises an     exception. This issue has been present since `update_into` was originally introduced in cryptography 1.8.
    (CVE-2023-23931)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote MiracleLinux 9 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2023-6725:03 advisory.

    * python-cryptography: memory corruption via immutable objects (CVE-2023-23931)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the python-cryptography package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In     affected versions `Cipher.update_into` would accept Python objects which implement the buffer protocol,     but provide only immutable buffers. This would allow immutable objects (such as `bytes`) to be mutated,     thus violating fundamental rules of Python and resulting in corrupted output. This now correctly raises an     exception. This issue has been present since `update_into` was originally introduced in cryptography 1.8.
    (CVE-2023-23931)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:1767-1 advisory.

  - cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In     affected versions `Cipher.update_into` would accept Python objects which implement the buffer protocol,     but provide only immutable buffers. This would allow immutable objects (such as `bytes`) to be mutated,     thus violating fundamental rules of Python and resulting in corrupted output. This now correctly raises an     exception. This issue has been present since `update_into` was originally introduced in cryptography 1.8.
    (CVE-2023-23931)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-51706f88e3 advisory.

    Automatic update for python-cryptography-37.0.2-8.fc39.

    ##### **Changelog**

    ```
    * Wed Feb 22 2023 Christian Heimes <cheimes@redhat.com> - 37.0.2-8
    - Fix CVE-2023-23931: Don't allow update_into to mutate immutable objects, resolves rhbz#2171820
    - Fix FTBFS due to failing test_load_invalid_ec_key_from_pem and test_decrypt_invalid_decrypt, resolves     rhbz#2171661
    * Fri Jan 20 2023 Fedora Release Engineering <releng@fedoraproject.org> - 37.0.2-7
    - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
    * Fri Dec  9 2022 Christian Heimes <cheimes@redhat.com> - 37.0.2-6
    - Enable SHA1 signatures in test suite (ELN-only)

    ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has a package installed that is affected by a vulnerability as referenced in the python- cryptography-36.0.1-3.el9 build changelog.

  - Don't allow update_into to mutate immutable objects, resolves rhbz#2172399 (CVE-2023-23931)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2025:0095 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2023-23931:
    cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In     affected versions `Cipher.update_into` would accept Python objects which implement the buffer protocol,     but provide only immutable buffers. This would allow immutable objects (such as `bytes`) to be mutated,     thus violating fundamental rules of Python and resulting in corrupted output. This now correctly raises an     exception. This issue has been present since `update_into` was originally introduced in cryptography 1.8.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2024-8429:01 advisory.

    * pypa-setuptools: Regular Expression Denial of Service (ReDoS) in package_index.py (CVE-2022-40897)
      * python-cryptography: memory corruption via immutable objects (CVE-2023-23931)
      * python: Parsing errors in email/_parseaddr.py lead to incorrect value in email address part of tuple     (CVE-2023-27043)
      * python-urllib3: Cookie request header isn't stripped during cross-origin redirects (CVE-2023-43804)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Oracle Business Intelligence Enterprise Edition (OAS) 7.0.0.0 installed on the remote host is affected by multiple vulnerabilities as referenced in the January 2024 CPU advisory, including the following:

  - Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics     (component: Installation (Google Gson)). Supported versions that are affected are 6.4.0.0.0 and     7.0.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via     HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this     vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash     (complete DOS) of Oracle Business Intelligence Enterprise Edition. (CVE-2022-25647)

  - Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics     (component: Majel Mobile Service (JSON-java)). Supported versions that are affected are 6.4.0.0.0 and     7.0.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP     to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability     can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of     Oracle Business Intelligence Enterprise Edition. (CVE-2023-5072)

  - Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics     (component: Visual Analyzer (Snappy)). The supported version that is affected is 7.0.0.0.0. Easily     exploitable vulnerability allows unauthenticated attacker with network access via HTTP to     compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability     can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of     Oracle Business Intelligence Enterprise Edition. (CVE-2023-43642)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
186623	Ubuntu 20.04 LTS / 22.04 LTS / 23.04 / 23.10 : python-cryptography vulnerabilities (USN-6539-1)	Nessus	Ubuntu Local Security Checks	12/6/2023	9/3/2025	medium
197280	EulerOS Virtualization 3.0.6.0 : python-cryptography (EulerOS-SA-2024-1700)	Nessus	Huawei Local Security Checks	5/17/2024	5/17/2024	medium
292522	MiracleLinux 9 : python-cryptography-36.0.1-4.el9 (AXSA:2023-6725:03)	Nessus	Miracle Linux Local Security Checks	1/20/2026	1/20/2026	medium
188296	EulerOS 2.0 SP11 : python-cryptography (EulerOS-SA-2023-2706)	Nessus	Huawei Local Security Checks	1/16/2024	1/16/2024	medium
173959	SUSE SLES12 Security Update : python-cryptography (SUSE-SU-2023:1767-1)	Nessus	SuSE Local Security Checks	4/6/2023	7/14/2023	medium
194671	Fedora 39 : python-cryptography (2023-51706f88e3)	Nessus	Fedora Local Security Checks	4/29/2024	11/14/2024	critical
191409	CentOS 9 : python-cryptography-36.0.1-3.el9	Nessus	CentOS Local Security Checks	2/29/2024	4/26/2024	medium
239298	TencentOS Server 4: python-cryptography (TSSA-2025:0095)	Nessus	Tencent Local Security Checks	6/16/2025	11/20/2025	medium
293254	MiracleLinux 8 : python39:3.9 and python39-devel:3.9 (AXSA:2024-8429:01)	Nessus	Miracle Linux Local Security Checks	1/20/2026	1/20/2026	high
189732	Oracle Business Intelligence Enterprise Edition (OAS 7.0) (January 2024 CPU)	Nessus	Misc.	1/29/2024	1/30/2024	high

Detections

Analytics

Plugins Search

medium

medium

medium

medium

medium

critical

medium

medium

high

high