There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - treq is an HTTP library inspired by requests but written on top of Twisted's Agents. Treq's request
    methods (`treq.get`, `treq.post`, etc.) and `treq.client.HTTPClient` constructor accept cookies as a
    dictionary. Such cookies are not bound to a single domain, and are therefore sent to *every* domain
    ("supercookies"). This can potentially cause sensitive information to leak upon an HTTP redirect to a
    different domain., e.g. should `https://example.com` redirect to `http://cloudstorageprovider.com` the
    latter will receive the cookie `session`. Treq 2021.1.0 and later bind cookies given to request methods
    (`treq.request`, `treq.get`, `HTTPClient.request`, `HTTPClient.get`, etc.) to the origin of the *url*
    parameter. Users are advised to upgrade. For users unable to upgrade Instead of passing a dictionary as
    the *cookies* argument, pass a `http.cookiejar.CookieJar` instance with properly domain- and scheme-scoped
    cookies in it. (CVE-2022-23607)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 181f5e49-b71d-4527-9464-d4624d69acc3 advisory.

  - treq is an HTTP library inspired by requests but written on top of Twisted's Agents. Treq's request     methods (`treq.get`, `treq.post`, etc.) and `treq.client.HTTPClient` constructor accept cookies as a     dictionary. Such cookies are not bound to a single domain, and are therefore sent to *every* domain     (supercookies). This can potentially cause sensitive information to leak upon an HTTP redirect to a     different domain., e.g. should `https://example.com` redirect to `http://cloudstorageprovider.com` the     latter will receive the cookie `session`. Treq 2021.1.0 and later bind cookies given to request methods     (`treq.request`, `treq.get`, `HTTPClient.request`, `HTTPClient.get`, etc.) to the origin of the *url*     parameter. Users are advised to upgrade. For users unable to upgrade Instead of passing a dictionary as     the *cookies* argument, pass a `http.cookiejar.CookieJar` instance with properly domain- and scheme-scoped     cookies in it. (CVE-2022-23607)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - treq is an HTTP library inspired by requests but written on top of Twisted's Agents. Treq's request     methods (`treq.get`, `treq.post`, etc.) and `treq.client.HTTPClient` constructor accept cookies as a     dictionary. Such cookies are not bound to a single domain, and are therefore sent to *every* domain     (supercookies). This can potentially cause sensitive information to leak upon an HTTP redirect to a     different domain., e.g. should `https://example.com` redirect to `http://cloudstorageprovider.com` the     latter will receive the cookie `session`. Treq 2021.1.0 and later bind cookies given to request methods     (`treq.request`, `treq.get`, `HTTPClient.request`, `HTTPClient.get`, etc.) to the origin of the *url*     parameter. Users are advised to upgrade. For users unable to upgrade Instead of passing a dictionary as     the *cookies* argument, pass a `http.cookiejar.CookieJar` instance with properly domain- and scheme-scoped     cookies in it. (CVE-2022-23607)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Debian 9 host has packages installed that are affected by a vulnerability as referenced in the dla-2954 advisory.

  - treq is an HTTP library inspired by requests but written on top of Twisted's Agents. Treq's request     methods (`treq.get`, `treq.post`, etc.) and `treq.client.HTTPClient` constructor accept cookies as a     dictionary. Such cookies are not bound to a single domain, and are therefore sent to *every* domain     (supercookies). This can potentially cause sensitive information to leak upon an HTTP redirect to a     different domain., e.g. should `https://example.com` redirect to `http://cloudstorageprovider.com` the     latter will receive the cookie `session`. Treq 2021.1.0 and later bind cookies given to request methods     (`treq.request`, `treq.get`, `HTTPClient.request`, `HTTPClient.get`, etc.) to the origin of the *url*     parameter. Users are advised to upgrade. For users unable to upgrade Instead of passing a dictionary as     the *cookies* argument, pass a `http.cookiejar.CookieJar` instance with properly domain- and scheme-scoped     cookies in it. (CVE-2022-23607)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
414535	SCA: security update for treq (GHSA-fhpf-pp6p-55qc)	Tenable Self-Hosted Container Security	SCA Checks	1/23/2025	7/2/2026	high
439107	Alpine: multiple py3-treq packages: security update to 22.1.0-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	3/23/2026	7/2/2026	high
414535	SCA: security update for treq (GHSA-fhpf-pp6p-55qc)	Tenable Cloud Security	SCA Checks	1/23/2025	7/2/2026	high
439107	Alpine: multiple py3-treq packages: security update to 22.1.0-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	3/23/2026	7/2/2026	high
180364	FreeBSD : py-treq -- sensitive information leak vulnerability (181f5e49-b71d-4527-9464-d4624d69acc3)	Nessus	FreeBSD Local Security Checks	8/31/2023	1/29/2024	medium
230089	Linux Distros Unpatched Vulnerability : CVE-2022-23607	Nessus	Misc.	3/5/2025	8/2/2026	medium
159069	Debian DLA-2954-1 : python-treq - LTS security update	Nessus	Debian Local Security Checks	3/18/2022	1/29/2024	medium

Detections

Analytics

Plugins Search

high

high

high

high

medium

medium

medium