The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2025:0559 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2024-12718:
    Allows modifying some file metadata (e.g. last modified) with filter=dataor file permissions (chmod)     with filter=tarof files outside the extraction directory.
    You are affected by this vulnerability if using the tarfilemodule to extract untrusted tar archives     using TarFile.extractall()or TarFile.extract()using the filter=parameter with a value of dataor     tar. See the tarfile  extraction filters documentation     https://docs.python.org/3/library/tarfile.html#tarfile-extraction-filter for more information. Only     Python versions 3.12 or later are affected by these vulnerabilities, earlier versions don't include the     extraction filter feature.

    Note that for Python 3.14 or later the default value of filter=changed from no filtering to data, so     if you are relying on this new default behavior then your usage is also affected.

    Note that none of these vulnerabilities significantly affect the installation of source distributions     which are tar archives as source distributions already allow arbitrary code execution during the build     process. However when evaluating source distributions it's important to avoid installing source     distributions with suspicious links.

    CVE-2025-4138:
    Allows the extraction filter to be ignored, allowing symlink targets to point outside the destination     directory, and the modification of some file metadata.


    You are affected by this vulnerability if using the tarfilemodule to extract untrusted tar archives     using TarFile.extractall()or TarFile.extract()using the filter=parameter with a value of dataor     tar. See the tarfile  extraction filters documentation     https://docs.python.org/3/library/tarfile.html#tarfile-extraction-filter for more information.

    Note that for Python 3.14 or later the default value of filter=changed from no filtering to data, so     if you are relying on this new default behavior then your usage is also affected.

    Note that none of these vulnerabilities significantly affect the installation of source distributions     which are tar archives as source distributions already allow arbitrary code execution during the build     process. However when evaluating source distributions it's important to avoid installing source     distributions with suspicious links.

    CVE-2025-4330:
    Allows the extraction filter to be ignored, allowing symlink targets to point outside the destination     directory, and the modification of some file metadata.


    You are affected by this vulnerability if using the tarfilemodule to extract untrusted tar archives     using TarFile.extractall()or TarFile.extract()using the filter=parameter with a value of dataor     tar. See the tarfile  extraction filters documentation     https://docs.python.org/3/library/tarfile.html#tarfile-extraction-filter for more information.

    Note that for Python 3.14 or later the default value of filter=changed from no filtering to data, so     if you are relying on this new default behavior then your usage is also affected.

    Note that none of these vulnerabilities significantly affect the installation of source distributions     which are tar archives as source distributions already allow arbitrary code execution during the build     process. However when evaluating source distributions it's important to avoid installing source     distributions with suspicious links.

    CVE-2025-4435:
    When using a TarFile.errorlevel = 0and extracting with a filter the documented behavior is that any     filtered members would be skipped and not extracted. However the actual behavior of TarFile.errorlevel =     0in affected versions is that the member would still be extracted and not skipped.

    CVE-2025-4517:
    Allows arbitrary filesystem writes outside the extraction directory during extraction with filter=data.


    You are affected by this vulnerability if using the tarfilemodule to extract untrusted tar archives     using TarFile.extractall()or TarFile.extract()using the filter=parameter with a value of dataor     tar. See the tarfile  extraction filters documentation     https://docs.python.org/3/library/tarfile.html#tarfile-extraction-filter for more information.

    Note that for Python 3.14 or later the default value of filter=changed from no filtering to data, so     if you are relying on this new default behavior then your usage is also affected.

    Note that none of these vulnerabilities significantly affect the installation of source distributions     which are tar archives as source distributions already allow arbitrary code execution during the build     process. However when evaluating source distributions it's important to avoid installing source     distributions with suspicious links.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2025:0502 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2025-6069:
    The html.parser.HTMLParser class had worse-case quadratic complexity when processing certain crafted     malformed inputs potentially leading to amplified denial-of-service.

    CVE-2025-4517:
    Allows arbitrary filesystem writes outside the extraction directory during extraction with filter=data.


    You are affected by this vulnerability if using the tarfilemodule to extract untrusted tar archives     using TarFile.extractall()or TarFile.extract()using the filter=parameter with a value of dataor     tar. See the tarfile  extraction filters documentation     https://docs.python.org/3/library/tarfile.html#tarfile-extraction-filter for more information.

    Note that for Python 3.14 or later the default value of filter=changed from no filtering to `data,     so if you are relying on this new default behavior then your usage is also affected.

    Note that none of these vulnerabilities significantly affect the installation of source distributions     which are tar archives as source distributions already allow arbitrary code execution during the build     process. However when evaluating source distributions it's important to avoid installing source     distributions with suspicious links.

    CVE-2025-4435:
    When using a TarFile.errorlevel = 0and extracting with a filter the documented behavior is that any     filtered members would be skipped and not extracted. However the actual behavior of TarFile.errorlevel =     0in affected versions is that the member would still be extracted and not skipped.

    CVE-2025-4330:
    Allows the extraction filter to be ignored, allowing symlink targets to point outside the destination     directory, and the modification of some file metadata.


    You are affected by this vulnerability if using the tarfilemodule to extract untrusted tar archives     using TarFile.extractall()or TarFile.extract()using the filter=parameter with a value of dataor     tar. See the tarfile  extraction filters documentation     https://docs.python.org/3/library/tarfile.html#tarfile-extraction-filter for more information.

    Note that for Python 3.14 or later the default value of filter=changed from no filtering to `data,     so if you are relying on this new default behavior then your usage is also affected.

    Note that none of these vulnerabilities significantly affect the installation of source distributions     which are tar archives as source distributions already allow arbitrary code execution during the build     process. However when evaluating source distributions it's important to avoid installing source     distributions with suspicious links.

    CVE-2025-4138:
    Allows the extraction filter to be ignored, allowing symlink targets to point outside the destination     directory, and the modification of some file metadata.


    You are affected by this vulnerability if using the tarfilemodule to extract untrusted tar archives     using TarFile.extractall()or TarFile.extract()using the filter=parameter with a value of dataor     tar. See the tarfile  extraction filters documentation     https://docs.python.org/3/library/tarfile.html#tarfile-extraction-filter for more information.

    Note that for Python 3.14 or later the default value of filter=changed from no filtering to `data,     so if you are relying on this new default behavior then your usage is also affected.

    Note that none of these vulnerabilities significantly affect the installation of source distributions     which are tar archives as source distributions already allow arbitrary code execution during the build     process. However when evaluating source distributions it's important to avoid installing source     distributions with suspicious links.

    CVE-2024-12718:
    Allows modifying some file metadata (e.g. last modified) with filter=dataor file permissions (chmod)     with filter=tarof files outside the extraction directory.
    You are affected by this vulnerability if using the tarfilemodule to extract untrusted tar archives     using TarFile.extractall()or TarFile.extract()using the filter=parameter with a value of dataor     tar. See the tarfile  extraction filters documentation     https://docs.python.org/3/library/tarfile.html#tarfile-extraction-filter for more information. Only     Python versions 3.12 or later are affected by these vulnerabilities, earlier versions don't include the     extraction filter feature.

    Note that for Python 3.14 or later the default value of filter=changed from no filtering to `data,     so if you are relying on this new default behavior then your usage is also affected.

    Note that none of these vulnerabilities significantly affect the installation of source distributions     which are tar archives as source distributions already allow arbitrary code execution during the build     process. However when evaluating source distributions it's important to avoid installing source     distributions with suspicious links.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the python3 package has been released.

The CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS-STREAM8:CLSA-2026:1772631219 advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 10.0 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2025_10140 advisory.

    * cpython: Tarfile extracts filtered members when errorlevel=0 (CVE-2025-4435)

    * cpython: Bypass extraction filter to modify file metadata outside extraction directory (CVE-2024-12718)

    * cpython: Extraction filter bypass for linking outside extraction directory (CVE-2025-4330)

    * python: cpython: Arbitrary writes via tarfile realpath overflow (CVE-2025-4517)

    * cpython: python: Bypassing extraction filter to create symlinks to arbitrary targets outside extraction     directory (CVE-2025-4138)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
276070	TencentOS Server 3: python3 (TSSA-2025:0559)	Nessus	Tencent Local Security Checks	11/20/2025	3/11/2026	critical
276174	TencentOS Server 4: python3.11 (TSSA-2025:0502)	Nessus	Tencent Local Security Checks	11/20/2025	3/11/2026	critical
332463	Photon OS 5.0: Python3 PHSA-2025-5.0-91-0554	Nessus	PhotonOS Local Security Checks	8/5/2026	8/5/2026	critical
352527	CentOS Linux 8 [TuxCare] Security Update: platform-python / platform-python-debug / platform-python-devel / etc Multiple Vulnerabilities (CENTOS-STREAM8:CLSA-2026:1772631219)	Nessus	CentOS Local Security Checks	9/30/2026	10/1/2026	critical
358929	Rocky Linux 10.0 [CIQ] Security Update: python-unversioned-command / python3 / python3-debug / etc Multiple Vulnerabilities (crlsa-2025_10140)	Nessus	Rocky Linux Local Security Checks	10/1/2026	10/2/2026	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical