An update of the python3 package has been released.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2023:4288-1 advisory.

  - Werkzeug is a comprehensive WSGI web application library. If an upload of a file that starts with CR or LF     and then is followed by megabytes of data without these characters: all of these bytes are appended chunk     by chunk into internal bytearray and lookup for boundary is performed on growing buffer. This allows an     attacker to cause a denial of service by sending crafted multipart data to an endpoint that will parse it.
    The amount of CPU time required can block worker processes from handling legitimate requests. This     vulnerability has been patched in version 3.0.1. (CVE-2023-46136)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2023:7477 advisory.

    Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution     designed for on-premise or private cloud deployments.

    This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.13.24. See the     following advisory for the container images for this release:

    https://access.redhat.com/errata/RHSA-2023:7475

    Security Fix(es):

    * python-werkzeug: high resource consumption leading to denial of service     (CVE-2023-46136)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    All OpenShift Container Platform 4.13 users are advised to upgrade to these updated packages and images     when they are available in the appropriate release channel. To check for available updates, use the     OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at     https://docs.openshift.com/container-platform/4.13/updating/updating-cluster-cli.html

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Red Hat Enterprise Linux CoreOS 4 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:7610 advisory.

  - The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation     can reset many streams quickly, as exploited in the wild in August through October 2023. (CVE-2023-44487)

  - Werkzeug is a comprehensive WSGI web application library. If an upload of a file that starts with CR or LF     and then is followed by megabytes of data without these characters: all of these bytes are appended chunk     by chunk into internal bytearray and lookup for boundary is performed on growing buffer. This allows an     attacker to cause a denial of service by sending crafted multipart data to an endpoint that will parse it.
    The amount of CPU time required can block worker processes from handling legitimate requests. This     vulnerability has been patched in version 3.0.1. (CVE-2023-46136)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2024:0214 advisory.

    Werkzeug is a WSGI utility module. It includes a debugger, request and response objects, HTTP utilities to     handle entity tags, cache control headers, HTTP dates, cookie handling, file uploads, a URL routing system     and a numerous community contributed add-on modules.

    Werkzeug is unicode aware and does not enforce a specific template engine, database adapter or a specific     way of handling requests. It is useful for end user applications, such as blogs, wikis, and bulletin     boards, that need to  operate in a wide variety of server environments.

    Security Fix(es):

    * high resource consumption leading to denial of service (CVE-2023-46136)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE     page listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of python-werkzeug installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-46136 advisory.

  - Werkzeug is a comprehensive WSGI web application library. If an upload of a file that starts with CR or LF     and then is followed by megabytes of data without these characters: all of these bytes are appended chunk     by chunk into internal bytearray and lookup for boundary is performed on growing buffer. This allows an     attacker to cause a denial of service by sending crafted multipart data to an endpoint that will parse it.
    The amount of CPU time required can block worker processes from handling legitimate requests. This     vulnerability has been patched in version 3.0.1. (CVE-2023-46136)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:7473 advisory.

    Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution     designed for on-premise or private cloud deployments.

    This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.14.4. See the following     advisory for the container images for this release:

    https://access.redhat.com/errata/RHSA-2023:7470

    Security Fix(es):

    * python-werkzeug: high resource usage when parsing multipart form data     with many fields (CVE-2023-25577)
    * haproxy: Proxy forwards malformed empty Content-Length headers     (CVE-2023-40225)
    * python-werkzeug: high resource consumption leading to denial of service     (CVE-2023-46136)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    All OpenShift Container Platform 4.14 users are advised to upgrade to these updated packages and images     when they are available in the appropriate release channel. To check for available updates, use the     OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at     https://docs.openshift.com/container-platform/4.14/updating/updating_a_cluster/updating-cluster-cli.html

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2024:0189 advisory.

    Werkzeug is a WSGI utility module. It includes a debugger, request and response objects, HTTP utilities to     handle entity tags, cache control headers, HTTP dates, cookie handling, file uploads, a URL routing system     and a numerous community contributed add-on modules.

    Werkzeug is unicode aware and does not enforce a specific template engine, database adapter or a specific     way of handling requests. It is useful for end user applications, such as blogs, wikis, and bulletin     boards, that need to  operate in a wide variety of server environments.

    Security Fix(es):

    * high resource consumption leading to denial of service (CVE-2023-46136)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE     page listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Red Hat Enterprise Linux CoreOS 4 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:7473 advisory.

  - Werkzeug is a comprehensive WSGI web application library. Prior to version 2.2.3, Werkzeug's multipart     form data parser will parse an unlimited number of parts, including file parts. Parts can be a small     amount of bytes, but each requires CPU time to parse and may use more memory as Python data. If a request     can be made to an endpoint that accesses `request.data`, `request.form`, `request.files`, or     `request.get_data(parse_form_data=False)`, it can cause unexpectedly high resource usage. This allows an     attacker to cause a denial of service by sending crafted multipart data to an endpoint that will parse it.
    The amount of CPU time required can block worker processes from handling legitimate requests. The amount     of RAM required can trigger an out of memory kill of the process. Unlimited file parts can use up memory     and file handles. If many concurrent requests are sent continuously, this can exhaust or kill all     available workers. Version 2.2.3 contains a patch for this issue. (CVE-2023-25577)

  - HAProxy through 2.0.32, 2.1.x and 2.2.x through 2.2.30, 2.3.x and 2.4.x through 2.4.23, 2.5.x and 2.6.x     before 2.6.15, 2.7.x before 2.7.10, and 2.8.x before 2.8.2 forwards empty Content-Length headers,     violating RFC 9110 section 8.6. In uncommon cases, an HTTP/1 server behind HAProxy may interpret the     payload as an extra request. (CVE-2023-40225)

  - Werkzeug is a comprehensive WSGI web application library. If an upload of a file that starts with CR or LF     and then is followed by megabytes of data without these characters: all of these bytes are appended chunk     by chunk into internal bytearray and lookup for boundary is performed on growing buffer. This allows an     attacker to cause a denial of service by sending crafted multipart data to an endpoint that will parse it.
    The amount of CPU time required can block worker processes from handling legitimate requests. This     vulnerability has been patched in version 3.0.1. (CVE-2023-46136)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:9775 advisory.

    Red Hat Ceph Storage is a scalable, open, software-defined storage platform that combines the most stable     version of the Ceph storage system with a Ceph management platform, deployment utilities, and support     services.

    These new packages include numerous enhancements, security and bug fixes, and known issues. Space     precludes documenting all of these changes in this advisory. Users are directed to the Red Hat Ceph     Storage Release Notes for information on the most significant of these changes:

    https://docs.redhat.com/en/documentation/red_hat_ceph_storage/8/html/8.1_release_notes

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:7610 advisory.

    Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution     designed for on-premise or private cloud deployments.

    This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.12.45. See the     following advisory for the container images for this release:

    https://access.redhat.com/errata/RHSA-2023:7608

    Security Fix(es):

    * HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)     (CVE-2023-44487)

    * python-werkzeug: high resource consumption leading to denial of service (CVE-2023-46136)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    All OpenShift Container Platform 4.12 users are advised to upgrade to these updated packages and images     when they are available in the appropriate release channel. To check for available updates, use the     OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at     https://docs.openshift.com/container-platform/4.12/updating/updating-cluster-cli.html

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of IBM Spectrum Protect Plus Web UI installed on the remote host is prior to 10.1.17.1 IBM Spectrum Protect Plus. It is, therefore, affected by multiple vulnerabilities as referenced in the 7237702 advisory.

  - This affects the package node-notifier before 9.0.0. It allows an attacker to run arbitrary commands on     Linux machines due to the options params not being sanitised when being passed an array. (CVE-2020-7789)

  - Flask is a lightweight WSGI web application framework. When all of the following conditions are met, a     response containing data intended for one client may be cached and subsequently sent by the proxy to other     clients. If the proxy also caches `Set-Cookie` headers, it may send one client's `session` cookie to other     clients. The severity depends on the application's use of the session and the proxy's behavior regarding     cookies. The risk depends on all these conditions being met. 1. The application must be hosted behind a     caching proxy that does not strip cookies or ignore responses with cookies. 2. The application sets     `session.permanent = True` 3. The application does not access or modify the session at any point during a     request. 4. `SESSION_REFRESH_EACH_REQUEST` enabled (the default). 5. The application does not set a     `Cache-Control` header to indicate that a page is private or should not be cached. This happens because     vulnerable versions of Flask only set the `Vary: Cookie` header when the session is accessed or modified,     not when it is refreshed (re-sent to update the expiration) without being accessed or modified. This issue     has been fixed in versions 2.3.2 and 2.2.5. (CVE-2023-30861)

  - Requests is a HTTP library. Since Requests 2.3.0, Requests has been leaking Proxy-Authorization headers to     destination servers when redirected to an HTTPS endpoint. This is a product of how we use     `rebuild_proxies` to reattach the `Proxy-Authorization` header to requests. For HTTP connections sent     through the tunnel, the proxy will identify the header in the request itself and remove it prior to     forwarding to the destination server. However when sent over HTTPS, the `Proxy-Authorization` header must     be sent in the CONNECT request as the proxy has no visibility into the tunneled request. This results in     Requests forwarding proxy credentials to the destination server unintentionally, allowing a malicious     actor to potentially exfiltrate sensitive information. This issue has been patched in version 2.31.0.
    (CVE-2023-32681)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
234863	Photon OS 4.0: Python3 PHSA-2025-4.0-0788	Nessus	PhotonOS Local Security Checks	4/26/2025	5/5/2025	low
184122	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : python-Werkzeug (SUSE-SU-2023:4288-1)	Nessus	SuSE Local Security Checks	11/1/2023	11/2/2023	high
194439	RHEL 9 : OpenShift Container Platform 4.13.24 (RHSA-2023:7477)	Nessus	Red Hat Local Security Checks	4/29/2024	11/7/2024	high
189453	RHCOS 4 : OpenShift Container Platform 4.12.45 (RHSA-2023:7610)	Nessus	Red Hat Local Security Checks	1/24/2024	4/17/2024	high
234864	Photon OS 5.0: Python3 PHSA-2025-5.0-0511	Nessus	PhotonOS Local Security Checks	4/26/2025	4/26/2025	low
189079	RHEL 9 : Red Hat OpenStack Platform 17.1 (python-werkzeug) (RHSA-2024:0214)	Nessus	Red Hat Local Security Checks	1/16/2024	11/7/2024	high
201581	CBL Mariner 2.0 Security Update: python-werkzeug (CVE-2023-46136)	Nessus	MarinerOS Local Security Checks	7/3/2024	7/3/2024	high
193429	RHEL 8 / 9 : OpenShift Container Platform 4.14.4 (RHSA-2023:7473)	Nessus	Red Hat Local Security Checks	4/17/2024	11/7/2024	high
194379	RHEL 8 : Red Hat OpenStack Platform 17.1 (python-werkzeug) (RHSA-2024:0189)	Nessus	Red Hat Local Security Checks	4/28/2024	11/7/2024	high
189458	RHCOS 4 : OpenShift Container Platform 4.14.4 (RHSA-2023:7473)	Nessus	Red Hat Local Security Checks	1/24/2024	4/17/2024	high
240647	RHEL 9 : Red Hat Ceph Storage 8.1 (RHSA-2025:9775)	Nessus	Red Hat Local Security Checks	6/26/2025	6/26/2025	medium
193432	RHEL 8 / 9 : OpenShift Container Platform 4.12.45 (RHSA-2023:7610)	Nessus	Red Hat Local Security Checks	4/17/2024	11/7/2024	critical
240343	IBM Spectrum Protect Plus Web UI 10.1.0 < 10.1.17.1 (7237702)	Nessus	Misc.	6/25/2025	6/25/2025	high

Detections

Analytics

Plugins Search

low

high

high

high

low

high

high

high

high

high

medium

critical

high