The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2024:0261 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2019-11236:
    In the urllib3 library through 1.24.1 for Python, CRLF injection is possible if the attacker controls the     request parameter.

    CVE-2019-11324:
    The urllib3 library before 1.24.2 for Python mishandles certain cases where the desired set of CA     certificates is different from the OS store of CA certificates, which results in SSL connections     succeeding in situations where a verification failure is the correct outcome. This is related to use of     the ssl_context, ca_certs, or ca_certs_dir argument.

    CVE-2019-16056:
    An issue was discovered in Python through 2.7.16, 3.x through 3.5.7, 3.6.x through 3.6.9, and 3.7.x     through 3.7.4. The email module wrongly parses email addresses that contain multiple @ characters. An     application that uses the email module and implements some kind of checks on the From/To headers of a     message could be tricked into accepting an email address that should be denied. An attack may be the same     as in CVE-2019-11340; however, this CVE applies to Python more generally.

    CVE-2019-16935:
    The documentation XML-RPC server in Python through 2.7.16, 3.x through 3.6.9, and 3.7.x through 3.7.4 has     XSS via the server_title field. This occurs in Lib/DocXMLRPCServer.py in Python 2.x, and in     Lib/xmlrpc/server.py in Python 3.x. If set_server_title is called with untrusted input, arbitrary     JavaScript can be delivered to clients that visit the http URL for this server.

    CVE-2019-6446:
    An issue was discovered in NumPy 1.16.0 and earlier. It uses the pickle Python module unsafely, which     allows remote attackers to execute arbitrary code via a crafted serialized object, as demonstrated by a     numpy.load call. NOTE: third parties dispute this issue because it is  a behavior that might have     legitimate applications in (for example)  loading serialized Python object arrays from trusted and     authenticated  sources

    CVE-2019-7164:
    SQLAlchemy through 1.2.17 and 1.3.x through 1.3.0b2 allows SQL Injection via the order_by parameter.

    CVE-2019-7548:
    SQLAlchemy 1.2.17 has SQL Injection when the group_by parameter can be controlled.

    CVE-2019-9636:
    Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode Encoding     (with an incorrect netloc) during NFKC normalization. The impact is: Information disclosure (credentials,     cookies, etc. that are cached against a given hostname). The components are: urllib.parse.urlsplit,     urllib.parse.urlparse. The attack vector is: A specially crafted URL could be incorrectly parsed to locate     cookies or authentication data and send that information to a different host than when parsed correctly.
    This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.7, v3.5.8,     v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1;
    v3.7.3, v3.7.3rc1, v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1,     v3.7.8, v3.7.8rc1, v3.7.9.

    CVE-2019-9740:
    An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3.
    CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument     to urllib.request.urlopen with \r\n (specifically in the query string after a ? character) followed by an     HTTP header or a Redis command. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10,     v3.5.10rc1, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12,     v3.6.9, v3.6.9rc1; v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1,     v3.7.8, v3.7.8rc1, v3.7.9.

    CVE-2019-9947:
    An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3.
    CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument     to urllib.request.urlopen with \r\n (specifically in the path component of a URL that lacks a ? character)     followed by an HTTP header or a Redis command. This is similar to the CVE-2019-9740 query string issue.
    This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.8, v3.5.8rc1,     v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.4,     v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9.

    CVE-2019-9948:
    urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote     attackers to bypass protection mechanisms that blacklist file: URIs, as demonstrated by triggering a     urllib.urlopen('local_file:///etc/passwd') call.

    CVE-2020-26137:
    urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as     demonstrated by inserting CR and LF control characters in the first argument of putrequest(). NOTE: this     is similar to CVE-2020-26116.

    CVE-2020-27619:
    In Python 3 through 3.9.0, the Lib/test/multibytecodec_support.py CJK codec tests call eval() on content     retrieved via HTTP.

    CVE-2020-27783:
    A XSS vulnerability was discovered in python-lxml's clean module. The module's parser didn't properly     imitate browsers, which caused different behaviors between the sanitizer and the user's page. A remote     attacker could exploit this flaw to run arbitrary HTML/JS code.

    CVE-2020-28493:
    This affects the package jinja2 from 0.0.0 and before 2.11.3. The ReDoS vulnerability is mainly due to the     `_punctuation_re regex` operator and its use of multiple wildcards. The last wildcard is the most     exploitable as it searches for trailing punctuation. This issue can be mitigated by Markdown to format     user content instead of the urlize filter, or by implementing request timeouts and limiting process     memory.

    CVE-2021-20095:
    A flaw was found in python-babel. A path traversal vulnerability was found in how locale data files are     checked and loaded within python-babel, allowing a local attacker to trick an application that uses     python-babel to load a file outside of the intended locale directory. The highest threat from this     vulnerability is to data confidentiality and integrity as well as service availability.

    CVE-2021-23336:
    The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before     3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to Web Cache Poisoning via urllib.parse.parse_qsl and     urllib.parse.parse_qs by using a vector called parameter cloaking. When the attacker can separate query     parameters using a semicolon (;), they can cause a difference in the interpretation of the request between     the proxy (running with default configuration) and the server. This can result in malicious requests being     cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and     therefore would not include it in a cache key of an unkeyed parameter.

    CVE-2021-28957:
    An XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3. When disabling     the safe_attrs_only and forms arguments, the Cleaner class does not remove the formaction attribute     allowing for JS to bypass the sanitizer. A remote attacker could exploit this flaw to run arbitrary JS     code on users who interact with incorrectly sanitized HTML. This issue is patched in lxml 4.6.3.

    CVE-2021-3177:
    Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to     remote code execution in certain Python applications that accept floating-point numbers as untrusted     input, as demonstrated by a 1e300 argument to c_double.from_param. This occurs because sprintf is used     unsafely.

    CVE-2021-3733:
    There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP     server that an HTTP client (such as web browser) connects to, could trigger a Regular Expression Denial of     Service (ReDOS) during an authentication request with a specially crafted payload that is sent by the     server to the client. The greatest threat that this flaw poses is to application availability.

    CVE-2021-3737:
    A flaw was found in python. An improperly handled HTTP response in the HTTP client code of python may     allow a remote attacker, who controls the HTTP server, to make the client script enter an infinite loop,     consuming CPU time. The highest threat from this vulnerability is to system availability.

    CVE-2021-4189:
    A flaw was found in Python, specifically in the FTP (File Transfer Protocol) client library in PASV     (passive) mode. The issue is how the FTP client trusts the host from the PASV response by default. This     flaw allows an attacker to set up a malicious FTP server that can trick FTP clients into connecting back     to a given IP address and port. This vulnerability could lead to FTP client scanning ports, which     otherwise would not have been possible.

    CVE-2021-42771:
    Babel.Locale in Babel before 2.9.1 allows attackers to load arbitrary locale .dat files (containing     serialized Python objects) via directory traversal, leading to code execution.

    CVE-2021-43818:
    lxml is a library for processing XML and HTML in the Python language. Prior to version 4.6.5, the HTML     Cleaner in lxml.html lets certain crafted script content pass through, as well as script content in SVG     files embedded using data URIs. Users that employ the HTML cleaner in a security relevant context should     upgrade to lxml 4.6.5 to receive a patch. There are no known workarounds available.

    CVE-2022-0391:
    A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform     Resource Locator (URL) strings into components. The issue involves how the urlparse method does not     sanitize input and allows characters like '\r' and '\n' in the URL path. This flaw allows an attacker to     input a crafted URL, leading to injection attacks. This flaw affects Python versions prior to 3.10.0b1,     3.9.5, 3.8.11, 3.7.11 and 3.6.14.

    CVE-2022-45061:
    An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path     when processing some inputs to the IDNA (RFC 3490) decoder, such that a crafted, unreasonably long name     being presented to the decoder could lead to a CPU denial of service. Hostnames are often supplied by     remote servers that could be controlled by a malicious actor; in such a scenario, they could trigger     excessive CPU consumption on the client attempting to make use of an attacker-supplied supposed hostname.
    For example, the attack payload could be placed in the Location header of an HTTP response with status     code 302. A fix is planned in 3.11.1, 3.10.9, 3.9.16, 3.8.16, and 3.7.16.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

遠端 Debian 9 主機上安裝的多個套件受到 dla-2919 公告中提及的多個弱點影響。

  - 在 Python 3.x 至 3.9.1 版中， _ctypes/callproc.c 的 PyCArg_repr 中存在緩衝區溢位問題，可能導致在某些將浮點數接受為未受信任輸入的 Python 應用程式中執行遠端程式碼， c_double.from_param 的 1e300 引數即為一例。這是未安全使用 sprintf 所致。(CVE-2021-3177)

  - 在 Python 中發現一個缺陷瑕疵，尤其是在 PASV (被動式) 模式下的 FTP (檔案傳輸通訊協定) 用戶端程式庫中。問題在於 FTP 用戶端在預設情況下如何信任來自 PASV 回應的主機。此缺陷允許攻擊者設定惡意的 FTP 伺服器，誘騙 FTP 用戶端重新連線至指定的 IP 位址和連接埠。此弱點可導致 FTP 用戶端掃描連接埠，而這本來是不可能的。(CVE-2021-4189)

請注意，Nessus 並未測試此問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

遠端 CentOS Linux 8 主機上安裝的多個套件受到 CESA-2022: 1986 公告中提及的多個弱點影響。

  - python：urllib: HTTP 用戶端可能在 100 Continue 回應中發生無限迴圈 (CVE-2021-3737)

  - python：ftplib 不應使用 PASV 回應中的主機 (CVE-2021-4189)

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼。

遠端 CentOS Linux 8 主機上安裝的多個套件受到 CESA-2022: 1821 公告中提及的多個弱點影響。

  - python：urllib: AbstractBasicAuthHandler 中的規則運算式 DoS (CVE-2021-3733)

  - python：urllib: HTTP 用戶端可能在 100 Continue 回應中發生無限迴圈 (CVE-2021-3737)

  - python：ftplib 不應使用 PASV 回應中的主機 (CVE-2021-4189)

  - python-lxml：HTML Cleaner 允許特製和 SVG 內嵌指令碼通過 (CVE-2021-43818)

  - python：urllib.parse 未清理包含 ASCII 新行和索引標籤的 URL (CVE-2022-0391)

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼。

遠端 Redhat Enterprise Linux 8 主機上安裝的套件受到 RHSA-2022:1986 公告中提及的多個弱點影響。

  - python：urllib：HTTP 用戶端可能在 100 Continue 回應中發生無限迴圈 (CVE-2021-3737)

  - python：ftplib 不應使用 PASV 回應中的主機 (CVE-2021-4189)

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

遠端主機上安裝的 python27 為 2.7.18-2.142 之前版本。因此，會受到 ALAS-2022-1593 公告中所提及的多個弱點影響。

  - 在 Python 3 3.9.0 之前版本中，Lib/test/multibytecodec_support.py CJK 轉碼器測試會針對透過 HTTP 擷取的內容呼叫 eval()。(CVE-2020-27619)

  - python/cpython 套件 0 至 3.6.13 之前版本、3.7.0 至 3.7.10 之前版本、3.8.0 至 3.8.8 之前版本、3.9.0 至 3.9.2 之前版本容易受到 Web 快取毒害攻擊，攻擊者可使用一個稱為參數偽裝的向量透過 urllib.parse.parse_qsl 和 urllib.parse.parse_qs 發動攻擊。當攻擊者可使用分號 (;) 分隔查詢參數時，可造成 Proxy (以預設組態執行) 和伺服器之間的要求解譯不同。這可導致將惡意要求快取為完全安全的要求，因為 Proxy 通常不會將分號視為分隔符號，因此不會將其包含在無索引鍵參數的快取金鑰中。(CVE-2021-23336)

  - urllib 的 AbstractBasicAuthHandler 類別中有一個缺陷。控制 HTTP 用戶端 (例如網頁瀏覽器) 所連線之惡意 HTTP 伺服器的攻擊者，可使用伺服器傳送至用戶端的特製承載，在驗證要求期間觸發規則運算式拒絕服務 (ReDOS)。此缺陷對應用程式的可用性威脅最大。
    (CVE-2021-3733)

  - 在 python 中發現一個缺陷。由於未正確處理 Python HTTP 用戶端程式碼中的 HTTP 回應，這就允許能夠控制 HTTP 伺服器的遠端攻擊者使用戶端指令碼進入無限迴圈，進而消耗 CPU 時間。此弱點對系統可用性威脅最大。(CVE-2021-3737)

  - 在 Python 中發現一個缺陷，尤其是在 urllib.parse 模組中。此模組有助於將統一資源定位器 (URL) 字串分解為多個元件。此問題涉及如何讓 urlparse 方法不審查輸入，以及如何在 URL 路徑中允許使用「\r」和「」等字元。此缺陷允許攻擊者輸入建構的 URL，進而導致插入攻擊。此缺陷會影響 Python 3.10.0b1、3.9.5、3.8.11、3.7.11 和 3.6.14 之前的版本。(CVE-2022-0391)

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼。

遠端 Debian 10 主機上安裝的多個套件受到 dla-3477 公告中提及的多個弱點影響。

  - 在 Python (即 CPython) 3.10.8 和之前的所有版本中，mailcap 模組不會將逸出字元新增到在系統 mailcap 檔案中發現的命令中。這可能允許攻擊者將 shell 命令插入使用未受信任的輸入呼叫 mailcap.findmatch 的應用程式中 (若未驗證使用者提供的檔案名稱或引數) 。此修正也已反向移植至 3.7、 3.8、 3.9 (CVE-2015-20107)

  - 在 python 中發現一個缺陷。在使用非二進位基底的二次時間複雜度演算法中，當使用 int(text) 時，系統可能需要 50 秒才能剖析具有 100,000 位數的 int 字串，而對於具有 1,000,000 位數的 int 字串，則需要 5 秒 (二進位基底爲 2、4、8、16 和 32 的 float、decimal、int.from_bytes() 和 int() 不受影響)。此弱點對系統可用性威脅最大。(CVE-2020-10735)

  - Python 3 的 pydoc 中有一個瑕疵。本機或鄰近攻擊者若發現或能夠誘騙其他本機或鄰近使用者啟動 pydoc 伺服器，則可以存取此伺服器，並藉此洩漏他們通常無法存取的屬於其他使用者的敏感資訊。此瑕疵對資料機密性的風險最大。此瑕疵影響 Python 3.8.9 之前版本、Python 3.9.3 之前版本以及 Python 3.10.0a7 之前版本。(CVE-2021-3426)

  - urllib 的 AbstractBasicAuthHandler 類別中有一個缺陷。控制 HTTP 用戶端 (例如網頁瀏覽器) 所連線之惡意 HTTP 伺服器的攻擊者，可使用伺服器傳送至用戶端的特製承載，在驗證要求期間觸發規則運算式拒絕服務 (ReDOS)。此缺陷對應用程式的可用性威脅最大。
    (CVE-2021-3733)

  - 在 python 中發現一個缺陷。由於未正確處理 Python HTTP 用戶端程式碼中的 HTTP 回應，這就允許能夠控制 HTTP 伺服器的遠端攻擊者使用戶端指令碼進入無限迴圈，進而消耗 CPU 時間。此弱點對系統可用性威脅最大。(CVE-2021-3737)

  - 在 Python 中發現一個缺陷瑕疵，尤其是在 PASV (被動式) 模式下的 FTP (檔案傳輸通訊協定) 用戶端程式庫中。問題在於 FTP 用戶端在預設情況下如何信任來自 PASV 回應的主機。此缺陷允許攻擊者設定惡意的 FTP 伺服器，誘騙 FTP 用戶端重新連線至指定的 IP 位址和連接埠。此弱點可導致 FTP 用戶端掃描連接埠，而這本來是不可能的。(CVE-2021-4189)

  - 在 Python 3.11.1 之前版本中發現一個問題。處理 IDNA (RFC 3490) 解碼器的部分輸入時，一個路徑中存在不必要的二次方演算法，如此一來，向解碼器顯示特製的過長名稱可導致 CPU 拒絕服務。主機名稱通常由遠端伺服器提供，而伺服器可能被惡意使用者控制，在這種情況下，他們可在嘗試使用攻擊者提供的假想主機名稱的用戶端上觸發 CPU 過度消耗。
    例如，可以在狀態碼為 302 的 HTTP 回應的 Location 標頭中放置攻擊承載。計劃在 3.11.1、3.10.9、3.9.16、3.8.16 和 3.7.16 中進行修正。(CVE-2022-45061)

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

遠端 Debian 11 主機上安裝的多個套件受到 dla-3980 公告中提及的多個弱點影響。

    - ------------------------------------------------- ------------------------------------ Debian LTS 公告 DLA-3980-1 debian-lts@lists.debian.org https://www.debian.org/lts/security/Adrian Bunk 2024 年 12 月 2 日https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    套件：python3.9 版本：3.9.2-1+deb11u2 CVE ID： CVE-2015-20107 CVE-2020-10735 CVE-2021-3426 CVE-2021-3733 CVE-2021-3737 CVE-2021-4189 CVE-2021-28861 CVE-2021-29921 CVE-2022-42919 CVE-2022-45061 CVE-2023-6597 CVE-2023-24329 CVE-2023-27043 CVE-2023-40217 CVE-2024-0397 CVE-2024-0450 CVE-2024-4032 CVE-2024-6232 CVE-2024-6923 CVE-2024-7592 CVE-2024-8088 CVE-2024-9287 CVE-2024-11168 Debian 錯誤： 989195 1070135 1059298 1070133

    已經修正 Python3 解譯器中的多個弱點。

    CVE-2015-20107

        Mailcap 模組不會將逸出字元新增到在系統 mailcap 檔案中發現的命令中。

    CVE-2020-10735

        防止具有非常大 int 的 DoS

    CVE-2021-3426

        移除可能遭到濫用，藉此讀取磁碟上任意檔案的 pydoc getfile 功能

    CVE-2021-3733

        urllib 的 AbstractBasicAuthHandler 類別中發生規則運算式拒絕服務

    CVE-2021-3737

        HTTP 用戶端程式碼中的無限迴圈

    CVE-2021-4189

        使 ftplib 不信任 PASV 回應

    CVE-2021-28861

        http.server 中的開放重新導向弱點

    CVE-2021-29921

        不再允許 IPv4 位址中的前置零

    CVE-2022-42919

        不針對多處理使用 Linux 抽象套接組

    CVE-2022-45061

        IDNA 解碼器中的二次方時間

    CVE-2023-6597

        tempfile.TemporaryDirectory 無法移除 dir

    CVE-2023-24329

        去除 urlsplit 中的 C0 控制項和空格字元

    CVE-2023-27043

        拒絕 email.parseaddr() 中格式錯誤的位址

    CVE-2023-40217

        TLS 交握的 ssl.SSLSocket 繞過

    CVE-2024-0397

        ssl.SSLContext 中的爭用情形

    CVE-2024-0450

        Quoted-overlap zipbomb DoS

    CVE-2024-4032

        ipaddress 模組中有關私人位址的錯誤資訊

    CVE-2024-6232

        剖析 tarfile 標頭時發生 ReDoS

    CVE-2024-6923

        編碼電子郵件模組標頭中的新行

    CVE-2024-7592

        剖析具有反斜線的 cookie 的二次複雜度

    CVE-2024-8088

        迭代 zip 封存項目名稱時發生無限迴圈

    CVE-2024-9287

        venv 啟動指令碼未引用路徑

    CVE-2024-11168

        urllib 函式未正確驗證括弧中的主機

    針對 Debian 11 Bullseye，這些問題已在 3.9.2-1+deb11u2 版本中修正。

    建議您升級 python3.9 套件。

    如需 python3.9 的詳細安全性狀態，請參閱其安全追蹤頁面：
    https://security-tracker.debian.org/tracker/python3.9

    有關 Debian LTS 安全公告、如何將這些更新套用至您的系統以及常見問題的詳細資訊，請參閱：https://wiki.debian.org/LTS

Tenable 已直接從 Debian 安全公告擷取前置描述區塊。

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且供應商未提供可用的修補程式。

  - 在 Python 中發現一個缺陷瑕疵，尤其是在 PASV (被動式) 模式下的 FTP (檔案傳輸通訊協定) 用戶端程式庫中。問題在於 FTP 用戶端在預設情況下如何信任來自 PASV 回應的主機。此缺陷允許攻擊者設定惡意的 FTP 伺服器，誘騙 FTP 用戶端重新連線至指定的 IP 位址和連接埠。此弱點可導致 FTP 用戶端掃描連接埠，而這本來是不可能的。(CVE-2021-4189)

請注意，Nessus 依賴供應商報告的套件存在。

ID	名稱	產品	系列	已發布	已更新	嚴重性
236272	Alibaba Cloud Linux 3 : 0261: Moderate: python27:2.7 (ALINUX3-SA-2024:0261)	Nessus	Alibaba Cloud Linux Local Security Checks	2025/5/14	2025/9/23	critical
158032	Debian DLA-2919-1：python2.7 - LTS 安全性更新	Nessus	Debian Local Security Checks	2022/2/13	2023/11/9	critical
160950	CentOS 8：python3 (CESA-2022：1986)	Nessus	CentOS Local Security Checks	2022/5/10	2023/10/27	medium
160965	CentOS 8：python27: 2.7 (CESA-2022：1821)	Nessus	CentOS Local Security Checks	2022/5/10	2023/10/27	high
161022	RHEL 8：python3 (RHSA-2022:1986)	Nessus	Red Hat Local Security Checks	2022/5/11	2025/3/15	medium
162008	Amazon Linux AMI：python27 (ALAS-2022-1593)	Nessus	Amazon Linux Local Security Checks	2022/6/10	2024/12/11	critical
177875	Debian DLA-3477-1：python3.7 - LTS 安全性更新	Nessus	Debian Local Security Checks	2023/7/1	2025/1/22	high
211991	Debian dla-3980：idle-python3.9 - 安全性更新	Nessus	Debian Local Security Checks	2024/12/2	2024/12/2	critical
224168	Linux Distros 未修補弱點：CVE-2021-4189	Nessus	Misc.	2025/3/5	2025/11/5	medium

偵測

搜尋 Plugin

critical

critical

medium

high

medium

critical

high

critical

medium