The remote Ubuntu 23.04 host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5948-2 advisory.

    USN-5948-1 fixed vulnerabilities in Werkzeug. This update provides the corresponding updates for Ubuntu     23.04.



Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3346 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-3346-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                      Sylvain Beucler     February 27, 2023                             https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : python-werkzeug     Version        : 0.14.1+dfsg1-4+deb10u2     CVE ID         : CVE-2023-23934 CVE-2023-25577     Debian Bug     : 1031370

    Two vulnerabilities were discovered in Werkzeug, a collection of     utilities for WSGI (web) applications. An attacker may inject cookies     in specific situations, and cause a denial of service (DoS).

    CVE-2023-23934

        Werkzeug will parse the cookie `=__Host-test=bad` as
        __Host-test=bad`. If a Werkzeug application is running next to a         vulnerable or malicious subdomain which sets such a cookie using a         vulnerable browser, the Werkzeug application will see the bad         cookie value but the valid cookie key. Browsers may allow         nameless cookies that look like `=value` instead of         `key=value`. A vulnerable browser may allow a compromised         application on an adjacent subdomain to exploit this to set a         cookie like `=__Host-test=bad` for another subdomain.

    CVE-2023-25577

        Werkzeug's multipart form data parser will parse an unlimited         number of parts, including file parts. Parts can be a small amount         of bytes, but each requires CPU time to parse and may use more         memory as Python data. If a request can be made to an endpoint         that accesses `request.data`, `request.form`, `request.files`, or         `request.get_data(parse_form_data=False)`, it can cause         unexpectedly high resource usage. This allows an attacker to cause         a denial of service by sending crafted multipart data to an         endpoint that will parse it.

    For Debian 10 buster, these problems have been fixed in version     0.14.1+dfsg1-4+deb10u2.

    We recommend that you upgrade your python-werkzeug packages.

    For the detailed security status of python-werkzeug please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/python-werkzeug

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 ESM / 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5948-1 advisory.

    It was discovered that Werkzeug did not properly handle the parsing of nameless cookies. A remote attacker     could possibly use this issue to shadow other cookies. (CVE-2023-23934)

    It was discovered that Werkzeug could be made to process unlimited number of multipart form data parts. A     remote attacker could possibly use this issue to cause Werkzeug to consume resources, leading to a denial     of service. (CVE-2023-25577)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:1018 advisory.

    Werkzeug ======== Werkzeug started as simple collection of various     utilities for WSGI applications and has become one of the most advanced     WSGI utility modules. It includes a powerful debugger, full featured     request and response objects, HTTP utilities to handle entity tags, cache     control headers, HTTP dates, cookie handling, file uploads, a powerful URL     routing system and a bunch of community contributed addon modules. Werkzeug     is unicode aware and doesn't enforce a specific template engine, database     adapter or anything else. It doesn't even enforce a specific way of     handling requests and leaves all that up to the developer. It's most useful     for end user applications which should work on as many server environments     as possible (such as blogs, wikis, bulletin boards, etc.).

    Security Fix(es):

    * high resource usage when parsing multipart form data with many fields     (CVE-2023-25577)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE     page listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2024:0160 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2023-23934:
    Werkzeug is a comprehensive WSGI web application library. Browsers may allow nameless cookies that look     like `=value` instead of `key=value`. A vulnerable browser may allow a compromised application on an     adjacent subdomain to exploit this to set a cookie like `=__Host-test=bad` for another subdomain. Werkzeug     prior to 2.2.3 will parse the cookie `=__Host-test=bad` as __Host-test=bad`. If a Werkzeug application is     running next to a vulnerable or malicious subdomain which sets such a cookie using a vulnerable browser,     the Werkzeug application will see the bad cookie value but the valid cookie key. The issue is fixed in     Werkzeug 2.2.3.

    CVE-2023-25577:
    Werkzeug is a comprehensive WSGI web application library. Prior to version 2.2.3, Werkzeug's multipart     form data parser will parse an unlimited number of parts, including file parts. Parts can be a small     amount of bytes, but each requires CPU time to parse and may use more memory as Python data. If a request     can be made to an endpoint that accesses `request.data`, `request.form`, `request.files`, or     `request.get_data(parse_form_data=False)`, it can cause unexpectedly high resource usage. This allows an     attacker to cause a denial of service by sending crafted multipart data to an endpoint that will parse it.
    The amount of CPU time required can block worker processes from handling legitimate requests. The amount     of RAM required can trigger an out of memory kill of the process. Unlimited file parts can use up memory     and file handles. If many concurrent requests are sent continuously, this can exhaust or kill all     available workers. Version 2.2.3 contains a patch for this issue.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of IBM Spectrum Protect Plus Web UI installed on the remote host is prior to 10.1.17.1 IBM Spectrum Protect Plus. It is, therefore, affected by multiple vulnerabilities as referenced in the 7237702 advisory.

  - Jinja is an extensible templating engine. Prior to 3.1.6, an oversight in how the Jinja sandboxed     environment interacts with the |attr filter allows an attacker that controls the content of a template to     execute arbitrary Python code. To exploit the vulnerability, an attacker needs to control the content of a     template. Whether that is the case depends on the type of application using Jinja. This vulnerability     impacts users of applications which execute untrusted templates. Jinja's sandbox does catch calls to     str.format and ensures they don't escape the sandbox. However, it's possible to use the |attr filter to     get a reference to a string's plain format method, bypassing the sandbox. After the fix, the |attr filter     no longer bypasses the environment's attribute lookup. This vulnerability is fixed in 3.1.6.
    (CVE-2025-27516)

  - This affects the package node-notifier before 9.0.0. It allows an attacker to run arbitrary commands on     Linux machines due to the options params not being sanitised when being passed an array. (CVE-2020-7789)

  - Requests is a HTTP library. Since Requests 2.3.0, Requests has been leaking Proxy-Authorization headers to     destination servers when redirected to an HTTPS endpoint. This is a product of how we use     `rebuild_proxies` to reattach the `Proxy-Authorization` header to requests. For HTTP connections sent     through the tunnel, the proxy will identify the header in the request itself and remove it prior to     forwarding to the destination server. However when sent over HTTPS, the `Proxy-Authorization` header must     be sent in the CONNECT request as the proxy has no visibility into the tunneled request. This results in     Requests forwarding proxy credentials to the destination server unintentionally, allowing a malicious     actor to potentially exfiltrate sensitive information. This issue has been patched in version 2.31.0.
    (CVE-2023-32681)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
177460	Ubuntu 23.04 : Werkzeug vulnerabilities (USN-5948-2)	Nessus	Ubuntu Local Security Checks	6/20/2023	10/29/2024	low
171932	Debian dla-3346 : python-werkzeug - security update	Nessus	Debian Local Security Checks	2/27/2023	1/22/2025	low
172504	Ubuntu 16.04 ESM / 18.04 LTS / 20.04 LTS / 22.04 LTS : Werkzeug vulnerabilities (USN-5948-1)	Nessus	Ubuntu Local Security Checks	3/13/2023	8/27/2024	low
194302	RHEL 9 : Red Hat OpenStack Platform 17.0 (python-werkzeug) (RHSA-2023:1018)	Nessus	Red Hat Local Security Checks	4/28/2024	11/8/2024	low
235976	Alibaba Cloud Linux 3 : 0160: python-werkzeug (ALINUX3-SA-2024:0160)	Nessus	Alibaba Cloud Linux Local Security Checks	5/14/2025	5/14/2025	low
240343	IBM Spectrum Protect Plus Web UI 10.1.0 < 10.1.17.1 (7237702)	Nessus	Misc.	6/25/2025	3/11/2026	medium

Detections

Analytics

Plugins Search

low

low

low

low

low

medium