The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-1986 advisory.

    - Security fix for CVE-2021-4189: ftplib should not use the host from the PASV response     Resolves: rhbz#2036020

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the python2 packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in Python, specifically in the FTP (File Transfer Protocol) client library in PASV     (passive) mode. The issue is how the FTP client trusts the host from the PASV response by default. This     flaw allows an attacker to set up a malicious FTP server that can trick FTP clients into connecting back     to a given IP address and port. This vulnerability could lead to FTP client scanning ports, which     otherwise would not have been possible. (CVE-2021-4189)

  - A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform     Resource Locator (URL) strings into components. The issue involves how the urlparse method does not     sanitize input and allows characters like '\r' and '\n' in the URL path. This flaw allows an attacker to     input a crafted URL, leading to injection attacks. This flaw affects Python versions prior to 3.10.0b1,     3.9.5, 3.8.11, 3.7.11 and 3.6.14. (CVE-2022-0391)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:0882-1 advisory.

  - A flaw was found in Python, specifically in the FTP (File Transfer Protocol) client library in PASV     (passive) mode. The issue is how the FTP client trusts the host from the PASV response by default. This     flaw allows an attacker to set up a malicious FTP server that can trick FTP clients into connecting back     to a given IP address and port. This vulnerability could lead to FTP client scanning ports, which     otherwise would not have been possible. (CVE-2021-4189)

  - A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform     Resource Locator (URL) strings into components. The issue involves how the urlparse method does not     sanitize input and allows characters like '\r' and ' ' in the URL path. This flaw allows an attacker to     input a crafted URL, leading to injection attacks. This flaw affects Python versions prior to 3.10.0b1,     3.9.5, 3.8.11, 3.7.11 and 3.6.14. (CVE-2022-0391)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the python3 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform     Resource Locator (URL) strings into components. The issue involves how the urlparse method does not     sanitize input and allows characters like '\r' and ' ' in the URL path. This flaw allows an attacker to     input a crafted URL, leading to injection attacks. This flaw affects Python versions prior to 3.10.0b1,     3.9.5, 3.8.11, 3.7.11 and 3.6.14. (CVE-2022-0391)

  - A flaw was found in Python, specifically in the FTP (File Transfer Protocol) client library in PASV     (passive) mode. The issue is how the FTP client trusts the host from the PASV response by default. This     flaw allows an attacker to set up a malicious FTP server that can trick FTP clients into connecting back     to a given IP address and port. This vulnerability could lead to FTP client scanning ports, which     otherwise would not have been possible. (CVE-2021-4189)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the python3 packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform     Resource Locator (URL) strings into components. The issue involves how the urlparse method does not     sanitize input and allows characters like '\r' and '\n' in the URL path. This flaw allows an attacker to     input a crafted URL, leading to injection attacks. This flaw affects Python versions prior to 3.10.0b1,     3.9.5, 3.8.11, 3.7.11 and 3.6.14. (CVE-2022-0391)

  - python: ftplib should not use the host from the PASV response (CVE-2021-4189)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the python packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in Python, specifically in the FTP (File Transfer Protocol) client library in PASV     (passive) mode. The issue is how the FTP client trusts the host from the PASV response by default. This     flaw allows an attacker to set up a malicious FTP server that can trick FTP clients into connecting back     to a given IP address and port. This vulnerability could lead to FTP client scanning ports, which     otherwise would not have been possible. (CVE-2021-4189)

  - A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform     Resource Locator (URL) strings into components. The issue involves how the urlparse method does not     sanitize input and allows characters like '\r' and '\n' in the URL path. This flaw allows an attacker to     input a crafted URL, leading to injection attacks. This flaw affects Python versions prior to 3.10.0b1,     3.9.5, 3.8.11, 3.7.11 and 3.6.14. (CVE-2022-0391)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-b8559307db advisory.

    Automatic update for python2.7-2.7.18-20.fc37.

    ##### **Changelog**

    ```
    * Wed Feb 16 2022 Charalampos Stratakis <cstratak@redhat.com> - 2.7.18-20
    - Security fixes for CVE-2021-4189 and CVE-2022-0391     Resolves: rhbz#2047376

    ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the python3 package has been released.

According to the versions of the python packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in Python, specifically in the FTP (File Transfer Protocol) client library in PASV     (passive) mode. The issue is how the FTP client trusts the host from the PASV response by default. This     flaw allows an attacker to set up a malicious FTP server that can trick FTP clients into connecting back     to a given IP address and port. This vulnerability could lead to FTP client scanning ports, which     otherwise would not have been possible. (CVE-2021-4189)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Published	Updated	Severity
161323	Oracle Linux 8 : python3 (ELSA-2022-1986)	Nessus	Oracle Linux Local Security Checks	5/18/2022	10/22/2024	medium
165954	EulerOS Virtualization 3.0.6.0 : python2 (EulerOS-SA-2022-2585)	Nessus	Huawei Local Security Checks	10/10/2022	10/10/2023	high
159031	SUSE SLES12 Security Update : python3 (SUSE-SU-2022:0882-1)	Nessus	SuSE Local Security Checks	3/17/2022	7/14/2023	high
160660	EulerOS 2.0 SP10 : python3 (EulerOS-SA-2022-1650)	Nessus	Huawei Local Security Checks	5/6/2022	10/30/2023	high
163141	EulerOS Virtualization 2.10.1 : python3 (EulerOS-SA-2022-2063)	Nessus	Huawei Local Security Checks	7/14/2022	10/18/2023	high
165885	EulerOS Virtualization 3.0.6.6 : python (EulerOS-SA-2022-2529)	Nessus	Huawei Local Security Checks	10/9/2022	10/10/2023	high
211144	Fedora 37 : python2.7 (2022-b8559307db)	Nessus	Fedora Local Security Checks	11/14/2024	11/14/2024	high
203931	Photon OS 3.0: Python3 PHSA-2022-3.0-0463	Nessus	PhotonOS Local Security Checks	7/24/2024	7/24/2024	medium
162337	EulerOS 2.0 SP5 : python (EulerOS-SA-2022-1911)	Nessus	Huawei Local Security Checks	6/17/2022	3/21/2023	medium

Detections

Analytics

Plugins Search

medium

high

high

high

high

high

high

medium

medium