The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-7107 advisory.

    - Security fix for CVE-2025-0938     Resolves: RHEL-77261
    - Security fix for CVE-2024-9287 and CVE-2024-12254     Resolves: RHEL-64886, RHEL-70320

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the python3 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    The Python standard library functions `urllib.parse.urlsplit` and `urlparse` accepted domain names that     included square brackets which isn't valid according to RFC 3986. Square brackets are only meant to be     used as delimiters for specifying IPv6 and IPvFuture hosts in URLs. This could result in differential     parsing across the Python URL parser and other specification-compliant URL parsers.(CVE-2025-0938)

Tenable has extracted the preceding description block directly from the EulerOS python3 security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7348-1 advisory.

    It was discovered that the Python ipaddress module contained incorrect information about which IP address     ranges were considered private or globally reachable. This could possibly result in     applications applying incorrect security policies. This issue only affected Ubuntu 14.04 LTS and Ubuntu     16.04 LTS. (CVE-2024-4032)

    It was discovered that Python incorrectly handled quoting path names when using the venv module. A local     attacker able to control virtual environments could possibly use this issue to execute arbitrary code when     the virtual environment is activated. (CVE-2024-9287)

    It was discovered that Python incorrectly handled parsing bracketed hosts. A remote attacker could     possibly use this issue to perform a Server-Side Request Forgery (SSRF) attack. This issue only affected     Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2024-11168)

    It was discovered that Python incorrectly handled parsing domain names that included square brackets. A     remote attacker could possibly use this issue to perform a Server-Side Request Forgery (SSRF) attack.
    (CVE-2025-0938)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-b353a46e0c advisory.

    Security fixes for CVE-2024-11168 and CVE-2025-0938

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:6977 advisory.

    Python is an interpreted, interactive, object-oriented programming language, which includes modules,     classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to     many system calls and libraries, as well as to various windowing systems.

    Security Fix(es):

    * python: cpython: URL parser allowed square brackets in domain names (CVE-2025-0938)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:02074-1 advisory.

    Update to version 3.13.5.

    Security issues fixed:

    - CVE-2025-4517: arbitrary filesystem writes outside the extraction directory during extraction with     filter='data' (bsc#1244032)
    - CVE-2025-4516: use-after-free in the unicode-escape decoder when using the error handler (bsc#1243273).
    - CVE-2025-4330: extraction filter bypass for linking outside extraction directory (bsc#1244060)
    - CVE-2025-4138: may allow symlink targets to point outside the destination directory, and the     modification of some file metadata.
       (bsc#1244059)
    - CVE-2025-0938: domain names containing square brackets are not identified as incorrect by urlparse     (bsc#1236705).
    - CVE-2024-12718:  bypass extraction filter to modify file metadata outside extraction directory     (bsc#1244056)
    - CVE-2024-12254: memory exhaustion due to unbounded memory buffering in     `SelectorSocketTransport.writelines()`       (bsc#1234290).



Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
237062	Oracle Linux 9 : python3.12 (ELSA-2025-7107)	Nessus	Oracle Linux Local Security Checks	5/22/2025	5/22/2025	medium
238386	EulerOS 2.0 SP11 : python3 (EulerOS-SA-2025-1676)	Nessus	Huawei Local Security Checks	6/12/2025	6/12/2025	medium
232662	Ubuntu 14.04 LTS / 16.04 LTS / 20.04 LTS : Python vulnerabilities (USN-7348-1)	Nessus	Ubuntu Local Security Checks	3/12/2025	3/12/2025	medium
216668	Fedora 40 : python3.8 (2025-b353a46e0c)	Nessus	Fedora Local Security Checks	2/23/2025	2/23/2025	medium
235803	RHEL 9 : python3.9 (RHSA-2025:6977)	Nessus	Red Hat Local Security Checks	5/13/2025	7/1/2025	medium
240592	SUSE SLED15 / SLES15 Security Update : python313 (SUSE-SU-2025:02074-1)	Nessus	SuSE Local Security Checks	6/26/2025	7/8/2025	critical

Detections

Analytics

Plugins Search

medium

medium

medium

medium

medium

critical