The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4333-1 advisory.

    It was discovered that Python incorrectly stripped certain characters from requests. A remote attacker     could use this issue to perform CRLF injection. (CVE-2019-18348)

    It was discovered that Python incorrectly handled certain HTTP requests. An attacker could possibly use     this issue to cause a denial of service. (CVE-2020-8492)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the python3 package has been released.

# Python 3.6.11

Python 3.6.11 is the latest security fix release of Python 3.6.

  - bpo-39073: Disallow CR or LF in     email.headerregistry.Address arguments to guard against     header injection attacks.

  - bpo-38576: Disallow control characters in hostnames in     http.client, addressing CVE-2019-18348. Such potentially     malicious header injection URLs now cause a InvalidURL     to be raised.

  - bpo-39503: CVE-2020-8492: The AbstractBasicAuthHandler     class of the urllib.request module uses an inefficient     regular expression which can be exploited by an attacker     to cause a denial of service. Fix the regex to prevent     the catastrophic backtracking. Vulnerability reported by     Ben Caller and Matt Schwager.

Also fix a regression with `distutils.sysconfig.get_config_var('LIBPL')` value in Fedora specific patches.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Python reports :

The AbstractBasicAuthHandler class of the urllib.request module uses an inefficient regular expression which can be exploited by an attacker to cause a denial of service. Fix the regex to prevent the catastrophic backtracking. Vulnerability reported by Ben Caller and Matt Schwager.

Disallow control characters in hostnames in http.client, addressing CVE-2019-18348. Such potentially malicious header injection URLs now cause a InvalidURL to be raised.

Disallow CR or LF in email.headerregistry.Address arguments to guard against header injection attacks.

The version of F5 Networks BIG-IP installed on the remote host is prior to 17.5.1.1. It is, therefore, affected by a vulnerability as referenced in the K000153042 advisory.

    An issue was discovered in urllib2 in Python 2.x through 2.7.17 and urllib in Python 3.x through 3.8.0.
    CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument     to urllib.request.urlopen with \r\n (specifically in the host component of a URL) followed by an HTTP     header. This is similar to the CVE-2019-9740 query string issue and the CVE-2019-9947 path string issue.
    (This is not exploitable when glibc has CVE-2016-10739 fixed.). This is fixed in: v2.7.18, v2.7.18rc1;
    v3.5.10, v3.5.10rc1; v3.6.11, v3.6.11rc1, v3.6.12; v3.7.8, v3.7.8rc1, v3.7.9; v3.8.3, v3.8.3rc1, v3.8.4,     v3.8.4rc1, v3.8.5, v3.8.6, v3.8.6rc1.(CVE-2019-18348)

Tenable has extracted the preceding description block directly from the F5 Networks BIG-IP security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Python 3.5 has now entered 'security fixes only' mode, and as such the only changes since Python 3.5.4 are security fixes.

https://www.python.org/downloads/release/python-358/

https://docs.python.org/3.5/whatsnew/changelog.html#python-3-5-8

Security fix for CVE-2019-9740, CVE-2019-10160, CVE-2019-16935, CVE-2019-18348 , CVE-2019-16056.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The CentOS Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS6:CLSA-2026:1778769563 advisory.

  - Python 2.7.14 is vulnerable to a Heap-Buffer-Overflow as well as a Heap-Use-After-Free. Python versions     prior to 2.7.14 may also be vulnerable and it appears that Python 2.7.17 and prior may also be vulnerable     however this has not been confirmed. The vulnerability lies when multiply threads are handling large     amounts of data. In both cases there is essentially a race condition that occurs. For the Heap-Buffer-     Overflow, Thread 2 is creating the size for a buffer, but Thread1 is already writing to the buffer without     knowing how much to write. So when a large amount of data is being processed, it is very easy to cause     memory corruption using a Heap-Buffer-Overflow. As for the Use-After-Free,     Thread3->Malloc->Thread1->Free's->Thread2-Re-uses-Free'd Memory. The PSRT has stated that this is not a     security vulnerability due to the fact that the attacker must be able to run code, however in some     situations, such as function as a service, this vulnerability can potentially be used by an attacker to     violate a trust boundary, as such the DWF feels this issue deserves a CVE. (CVE-2018-1000030)

  - An issue was discovered in urllib2 in Python 2.x through 2.7.17 and urllib in Python 3.x through 3.8.0.
    CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument     to urllib.request.urlopen with \r\n (specifically in the host component of a URL) followed by an HTTP     header. This is similar to the CVE-2019-9740 query string issue and the CVE-2019-9947 path string issue.
    (This is not exploitable when glibc has CVE-2016-10739 fixed.). This is fixed in: v2.7.18, v2.7.18rc1;
    v3.5.10, v3.5.10rc1; v3.6.11, v3.6.11rc1, v3.6.12; v3.7.8, v3.7.8rc1, v3.7.9; v3.8.3, v3.8.3rc1, v3.8.4,     v3.8.4rc1, v3.8.5, v3.8.6, v3.8.6rc1. (CVE-2019-18348)

  - An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3.
    CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument     to urllib.request.urlopen with \r\n (specifically in the query string after a ? character) followed by an     HTTP header or a Redis command. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10,     v3.5.10rc1, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12,     v3.6.9, v3.6.9rc1; v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1,     v3.7.8, v3.7.8rc1, v3.7.9. (CVE-2019-9740)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for python fixes the following issues :

Security issues fixed :

CVE-2019-18348: Fixed a CRLF injection via the host part of the url passed to urlopen(). Now an InvalidURL exception is raised (bsc#1155094).

CVE-2019-9674: Improved the documentation to reflect the dangers of zip-bombs (bsc#1162825).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for python fixes the following issues :

Security issues fixed :

  - CVE-2019-18348: Fixed a CRLF injection via the host part     of the url passed to urlopen(). Now an InvalidURL     exception is raised (bsc#1155094).

  - CVE-2019-9674: Improved the documentation to reflect the     dangers of zip-bombs (bsc#1162825).

This update was imported from the SUSE:SLE-15:Update update project.

The version of python26 installed on the remote host is prior to 2.6.9-2.92. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2025-1972 advisory.

    A CRLF injection flaw was discovered in python in the way URLs are handled when doing an HTTP/HTTPS     connection (e.g. through urlopen() or HTTPConnection). An attacker who can control the url parameter     passed to urlopen method in the urllib/urllib2 modules can inject CRLF sequences and HTTP headers by     abusing the host part of the URL. (CVE-2019-18348)

    A flaw was found in python. In Lib/tarfile.py an attacker is able to craft a TAR archive leading to an     infinite loop when opened by tarfile.open, because _proc_pax lacks header validation. (CVE-2019-20907)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4273 advisory.

    Python is an interpreted, interactive, object-oriented programming language, which includes modules,     classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to     many system calls and libraries, as well as to various windowing systems.

    The following packages have been upgraded to a later upstream version: python27-python (2.7.18).
    (BZ#1882656)

    Security Fix(es):

    * python: CRLF injection via the host part of the url passed to urlopen() (CVE-2019-18348)

    * python: infinite loop in the tarfile module via crafted TAR archive (CVE-2019-20907)

    * python-pip: directory traversal in _download_http_url() function in src/pip/_internal/download.py     (CVE-2019-20916)

    * python: CRLF injection via HTTP request method in httplib/http.client (CVE-2020-26116)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * python27-python-pip: Bundles own CA bundle instead of using system CA bundle (BZ#1882668)

    * python27-python-pip: Contains multiple bundled libraries, and has no bundled() provides (BZ#1882669)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
135894	Ubuntu 16.04 LTS / 18.04 LTS : Python vulnerabilities (USN-4333-1)	Nessus	Ubuntu Local Security Checks	2020/4/22	2024/8/29	medium
137877	Photon OS 1.0: Python3 PHSA-2020-1.0-0304	Nessus	PhotonOS Local Security Checks	2020/6/29	2024/3/5	medium
138114	Fedora 32 : python36 (2020-8bdd3fd7a4)	Nessus	Fedora Local Security Checks	2020/7/6	2024/3/4	medium
138125	FreeBSD : Python -- multiple vulnerabilities (33c05d57-bf6e-11ea-ba1e-0800273f78d3)	Nessus	FreeBSD Local Security Checks	2020/7/6	2024/3/4	medium
253661	F5 Networks BIG-IP : Python urllib vulnerability (K000153042)	Nessus	F5 Networks Local Security Checks	2025/8/22	2026/3/13	medium
130793	Fedora 30 : python35 (2019-b06ec6159b)	Nessus	Fedora Local Security Checks	2019/11/12	2024/4/12	critical
351611	CentOS Linux 6 [TuxCare] Security Update: python / python-devel / python-libs / python-test / python-tools / etc Multiple Vulnerabilities (CENTOS6:CLSA-2026:1778769563)	Nessus	CentOS Local Security Checks	2026/9/30	2026/9/30	medium
136798	SUSE SLED15 / SLES15 Security Update : python (SUSE-SU-2020:1339-1)	Nessus	SuSE Local Security Checks	2020/5/22	2021/1/13	medium
136884	openSUSE Security Update : python (openSUSE-2020-696)	Nessus	SuSE Local Security Checks	2020/5/26	2020/5/28	medium
234998	Amazon Linux AMI : python26 (ALAS-2025-1972)	Nessus	Amazon Linux Local Security Checks	2025/4/30	2025/4/30	medium
170304	RHEL 7 : python27 (RHSA-2020:4273)	Nessus	Red Hat Local Security Checks	2023/1/23	2024/11/7	high

偵測

搜尋 Plugin

medium

medium

medium

medium

medium

critical

medium

medium

medium

medium

high