According to the versions of the python3 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    The Python standard library functions `urllib.parse.urlsplit` and `urlparse` accepted domain names that     included square brackets which isn't valid according to RFC 3986. Square brackets are only meant to be     used as delimiters for specifying IPv6 and IPvFuture hosts in URLs. This could result in differential     parsing across the Python URL parser and other specification-compliant URL parsers.(CVE-2025-0938)

Tenable has extracted the preceding description block directly from the EulerOS python3 security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-212be26bd1 advisory.

    Update to 3.12.9


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-10e053d399 advisory.

    Security fix for CVE-2025-0938

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-f613fe78b6 advisory.

    Security fix for CVE-2025-0938

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-36baebad86 advisory.

    Security fix for CVE-2025-0938


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4087 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4087-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                         Sean Whitton     March 20, 2025                                https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : python3.9     Version        : 3.9.2-1+deb11u3     CVE ID         : CVE-2022-0391 CVE-2025-0938 CVE-2025-1795

    Multiple vulnerabilities were discovered in modules shipped with     cpython 3.9, the primary interpreter for the Python programming     language.

    CVE-2022-0391

        Functions in the urllib.parse module did not sanitize URLs to remove         newline characters, which could lead to injection attacks.

    CVE-2025-0938

        Functions in the urllib.parse and urlparse modules accepted domain         names containing square brackets, which isn't valid.  These         delimiters are only permitted for IPv6 and IPvFuture hosts.  This         problem could result in differential parsing between the Python URL         parser and other specification-compliant URL parsers.

    CVE-2025-1795

        The implementations of e-mail header parsing and folding would         encode the comma used to separate list items, which could cause         receiving applications to interpret two items in the list as though         they were one item.

    For Debian 11 bullseye, these problems have been fixed in version     3.9.2-1+deb11u3.

    We recommend that you upgrade your python3.9 packages.

    For the detailed security status of python3.9 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/python3.9

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:02074-1 advisory.

    Update to version 3.13.5.

    Security issues fixed:

    - CVE-2025-4517: arbitrary filesystem writes outside the extraction directory during extraction with     filter='data' (bsc#1244032)
    - CVE-2025-4516: use-after-free in the unicode-escape decoder when using the error handler (bsc#1243273).
    - CVE-2025-4330: extraction filter bypass for linking outside extraction directory (bsc#1244060)
    - CVE-2025-4138: may allow symlink targets to point outside the destination directory, and the     modification of some file metadata.
       (bsc#1244059)
    - CVE-2025-0938: domain names containing square brackets are not identified as incorrect by urlparse     (bsc#1236705).
    - CVE-2024-12718:  bypass extraction filter to modify file metadata outside extraction directory     (bsc#1244056)
    - CVE-2024-12254: memory exhaustion due to unbounded memory buffering in     `SelectorSocketTransport.writelines()`       (bsc#1234290).



Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
238386	EulerOS 2.0 SP11 : python3 (EulerOS-SA-2025-1676)	Nessus	Huawei Local Security Checks	6/12/2025	6/12/2025	medium
215147	Fedora 41 : python3.12 (2025-212be26bd1)	Nessus	Fedora Local Security Checks	2/8/2025	2/8/2025	medium
216226	Fedora 40 : python3.10 (2025-10e053d399)	Nessus	Fedora Local Security Checks	2/13/2025	2/13/2025	medium
216231	Fedora 40 : python3.11 (2025-f613fe78b6)	Nessus	Fedora Local Security Checks	2/13/2025	2/13/2025	medium
216233	Fedora 41 : python3.14 (2025-36baebad86)	Nessus	Fedora Local Security Checks	2/13/2025	2/13/2025	medium
232991	Debian dla-4087 : idle-python3.9 - security update	Nessus	Debian Local Security Checks	3/20/2025	3/20/2025	medium
240592	SUSE SLED15 / SLES15 Security Update : python313 (SUSE-SU-2025:02074-1)	Nessus	SuSE Local Security Checks	6/26/2025	7/8/2025	critical

Detections

Analytics

Plugins Search

medium

medium

medium

medium

medium

medium

critical