The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:3511-2 advisory.

  - ** DISPUTED ** Python 3.x through 3.10 has an open redirection vulnerability in lib/http/server.py due to     no protection against multiple (/) at the beginning of URI path which may leads to information disclosure.
    NOTE: this is disputed by a third party because the http.server.html documentation page states Warning:
    http.server is not recommended for production. It only implements basic security checks. (CVE-2021-28861)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:3483-1 advisory.

  - ** DISPUTED ** Python 3.x through 3.10 has an open redirection vulnerability in lib/http/server.py due to     no protection against multiple (/) at the beginning of URI path which may leads to information disclosure.
    NOTE: this is disputed by a third party because the http.server.html documentation page states Warning:
    http.server is not recommended for production. It only implements basic security checks. (CVE-2021-28861)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:3511-1 advisory.

  - ** DISPUTED ** Python 3.x through 3.10 has an open redirection vulnerability in lib/http/server.py due to     no protection against multiple (/) at the beginning of URI path which may leads to information disclosure.
    NOTE: this is disputed by a third party because the http.server.html documentation page states Warning:
    http.server is not recommended for production. It only implements basic security checks. (CVE-2021-28861)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 35 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2022-61d8e8d880 advisory.

    Backport fix for CVE-2021-28861

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 36 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2022-4ac2e16969 advisory.

    Backport fix for CVE-2021-28861

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 36 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2022-2173709172 advisory.

    Backport fix for CVE-2021-28861

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 37 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2022-20116fb6aa advisory.

    Backport fix for CVE-2021-28861

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2022-2e93acb55d advisory.

    Automatic update for python3.6-3.6.15-12.fc38.

    ##### **Changelog**

    ```
    * Wed Sep 14 2022 Lumr Balhar <lbalhar@redhat.com> - 3.6.15-12
    - Fix for CVE-2021-28861     Resolves: rhbz#2120785

    ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:0833 advisory.

    Python is an interpreted, interactive, object-oriented programming language, which includes modules,     classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to     many system calls and libraries, as well as to various windowing systems.

    Security Fix(es):

    * python: int() type in PyLong_FromString() does not limit amount of digits converting text to int leading     to DoS (CVE-2020-10735)

    * python: open redirection vulnerability in lib/http/server.py may lead to information disclosure     (CVE-2021-28861)

    * Python: CPU denial of service via inefficient IDNA decoder (CVE-2022-45061)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-2764 advisory.

  - An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path     when processing some inputs to the IDNA (RFC 3490) decoder, such that a crafted, unreasonably long name     being presented to the decoder could lead to a CPU denial of service. Hostnames are often supplied by     remote servers that could be controlled by a malicious actor; in such a scenario, they could trigger     excessive CPU consumption on the client attempting to make use of an attacker-supplied supposed hostname.
    For example, the attack payload could be placed in the Location header of an HTTP response with status     code 302. A fix is planned in 3.11.1, 3.10.9, 3.9.16, 3.8.16, and 3.7.16. (CVE-2022-45061)

  - A flaw was found in python. In algorithms with quadratic time complexity using non-binary bases, when     using int(text), a system could take 50ms to parse an int string with 100,000 digits and 5s for     1,000,000 digits (float, decimal, int.from_bytes(), and int() for binary bases 2, 4, 8, 16, and 32 are not     affected). The highest threat from this vulnerability is to system availability. (CVE-2020-10735)

  - Python 3.x through 3.10 has an open redirection vulnerability in lib/http/server.py due to no protection     against multiple (/) at the beginning of URI path which may leads to information disclosure. NOTE: this is     disputed by a third party because the http.server.html documentation page states Warning: http.server is     not recommended for production. It only implements basic security checks. (CVE-2021-28861)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Oracle Business Intelligence Enterprise Edition (OAS) 7.0.0.0 installed on the remote host is affected by multiple vulnerabilities as referenced in the April 2024 CPU advisory, including the following:

  - Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics     (component: Analytics Server (urllib3)). The supported version that is affected is 7.0.0.0.0. Easily     exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise     Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability can result in     unauthorized creation, deletion or modification access to critical data or all Oracle Business     Intelligence Enterprise Edition accessible data as well as unauthorized access to critical data or     complete access to all Oracle Business Intelligence Enterprise Edition accessible data. (CVE-2023-43804)

  - Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics     (component: Analytics Web Answers). Supported versions that are affected are 7.0.0.0.0 and     12.2.1.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP     to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks require human     interaction from a person other than the attacker and while the vulnerability is in Oracle Business     Intelligence Enterprise Edition, attacks may significantly impact additional products (scope change).     Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to     some of Oracle Business Intelligence Enterprise Edition accessible data as well as unauthorized read     access to a subset of Oracle Business Intelligence Enterprise Edition accessible data. (CVE-2024-21064)

  - Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics     (component: Data Visualization). The supported version that is affected is 7.0.0.0.0. Easily exploitable     vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Business     Intelligence Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized read     access to a subset of Oracle Business Intelligence Enterprise Edition accessible data. (CVE-2024-21099)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2022:8353 advisory.

  - In Python (aka CPython) through 3.10.4, the mailcap module does not add escape characters into commands     discovered in the system mailcap file. This may allow attackers to inject shell commands into applications     that call mailcap.findmatch with untrusted input (if they lack validation of user-provided filenames or     arguments). (CVE-2015-20107)

  - ** DISPUTED ** Python 3.x through 3.10 has an open redirection vulnerability in lib/http/server.py due to     no protection against multiple (/) at the beginning of URI path which may leads to information disclosure.
    NOTE: this is disputed by a third party because the http.server.html documentation page states Warning:
    http.server is not recommended for production. It only implements basic security checks. (CVE-2021-28861)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202305-02 (Python, PyPy3: Multiple Vulnerabilities)

  - In Python (aka CPython) up to 3.10.8, the mailcap module does not add escape characters into commands     discovered in the system mailcap file. This may allow attackers to inject shell commands into applications     that call mailcap.findmatch with untrusted input (if they lack validation of user-provided filenames or     arguments). The fix is also back-ported to 3.7, 3.8, 3.9 (CVE-2015-20107)

  - A vulnerability was found in openstack-nova's console proxy, noVNC. By crafting a malicious URL, noVNC     could be made to redirect to any desired URL. (CVE-2021-3654)

  - The urllib3 library 1.26.x before 1.26.4 for Python omits SSL certificate validation in some cases     involving HTTPS to HTTPS proxies. The initial connection to the HTTPS proxy (if an SSLContext isn't given     via proxy_config) doesn't verify the hostname of the certificate. This means certificates for different     servers that still validate properly with the default urllib3 SSLContext will be silently accepted.
    (CVE-2021-28363)

  - ** DISPUTED ** Python 3.x through 3.10 has an open redirection vulnerability in lib/http/server.py due to     no protection against multiple (/) at the beginning of URI path which may leads to information disclosure.
    NOTE: this is disputed by a third party because the http.server.html documentation page states Warning:
    http.server is not recommended for production. It only implements basic security checks. (CVE-2021-28861)

  - In Python before 3,9,5, the ipaddress library mishandles leading zero characters in the octets of an IP     address string. This (in some situations) allows attackers to bypass access control that is based on IP     addresses. (CVE-2021-29921)

  - A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform     Resource Locator (URL) strings into components. The issue involves how the urlparse method does not     sanitize input and allows characters like '\r' and '\n' in the URL path. This flaw allows an attacker to     input a crafted URL, leading to injection attacks. This flaw affects Python versions prior to 3.10.0b1,     3.9.5, 3.8.11, 3.7.11 and 3.6.14. (CVE-2022-0391)

  - The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer     overflow that allows attackers to execute arbitrary code or eliminate expected cryptographic properties.
    This occurs in the sponge function interface. (CVE-2022-37454)

  - Python 3.9.x before 3.9.16 and 3.10.x before 3.10.9 on Linux allows local privilege escalation in a non-     default configuration. The Python multiprocessing library, when used with the forkserver start method on     Linux, allows pickles to be deserialized from any user in the same machine local network namespace, which     in many system configurations means any user on the same machine. Pickles can execute arbitrary code.
    Thus, this allows for local user privilege escalation to the user that any forkserver process is running     as. Setting multiprocessing.util.abstract_sockets_supported to False is a workaround. The forkserver start     method for multiprocessing is not the default start method. This issue is Linux specific because only     Linux supports abstract namespace sockets. CPython before 3.9 does not make use of Linux abstract     namespace sockets by default. Support for users manually specifying an abstract namespace socket was added     as a bugfix in 3.7.8 and 3.8.3, but users would need to make specific uncommon API calls in order to do     that in CPython before 3.9. (CVE-2022-42919)

  - An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path     when processing some inputs to the IDNA (RFC 3490) decoder, such that a crafted, unreasonably long name     being presented to the decoder could lead to a CPU denial of service. Hostnames are often supplied by     remote servers that could be controlled by a malicious actor; in such a scenario, they could trigger     excessive CPU consumption on the client attempting to make use of an attacker-supplied supposed hostname.
    For example, the attack payload could be placed in the Location header of an HTTP response with status     code 302. A fix is planned in 3.11.1, 3.10.9, 3.9.16, 3.8.16, and 3.7.16. (CVE-2022-45061)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2023:0833 advisory.

  - A flaw was found in python. In algorithms with quadratic time complexity using non-binary bases, when     using int(text), a system could take 50ms to parse an int string with 100,000 digits and 5s for     1,000,000 digits (float, decimal, int.from_bytes(), and int() for binary bases 2, 4, 8, 16, and 32 are not     affected). The highest threat from this vulnerability is to system availability. (CVE-2020-10735)

  - ** DISPUTED ** Python 3.x through 3.10 has an open redirection vulnerability in lib/http/server.py due to     no protection against multiple (/) at the beginning of URI path which may leads to information disclosure.
    NOTE: this is disputed by a third party because the http.server.html documentation page states Warning:
    http.server is not recommended for production. It only implements basic security checks. (CVE-2021-28861)

  - An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path     when processing some inputs to the IDNA (RFC 3490) decoder, such that a crafted, unreasonably long name     being presented to the decoder could lead to a CPU denial of service. Hostnames are often supplied by     remote servers that could be controlled by a malicious actor; in such a scenario, they could trigger     excessive CPU consumption on the client attempting to make use of an attacker-supplied supposed hostname.
    For example, the attack payload could be placed in the Location header of an HTTP response with status     code 302. A fix is planned in 3.11.1, 3.10.9, 3.9.16, 3.8.16, and 3.7.16. (CVE-2022-45061)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-ddde191e04 advisory.

    Automatic update for pypy3.10-7.3.12-1.3.10.fc39.

    ##### **Changelog**

    ```
    * Wed Jul 26 2023 Miro Hronok <mhroncok@redhat.com> - 7.3.12-1.3.10
    - Initial PyPy 3.10 package
    * Wed Jul 26 2023 Miro Hronok <mhroncok@redhat.com> - 7.3.12-1.3.9
    - Update to 7.3.12
    - Fixes: rhbz#2203423
    * Fri Jul 21 2023 Fedora Release Engineering <releng@fedoraproject.org> - 7.3.11-5.3.9
    - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
    * Mon May 29 2023 Charalampos Stratakis <cstratak@redhat.com> - 7.3.11-4.3.9
    - Security fix for CVE-2023-24329     Resolves: rhbz#2174020
    * Fri Feb 17 2023 Miro Hronok <mhroncok@redhat.com> - 7.3.11-3.3.9
    - On Fedora 38+, obsolete the pypy3.8 package which is no longer available
    * Fri Jan 20 2023 Fedora Release Engineering <releng@fedoraproject.org> - 7.3.11-2.3.9
    - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
    * Fri Dec 30 2022 Miro Hronok <mhroncok@redhat.com> - 7.3.11-1.3.9
    - Update to 7.3.11
    - Fixes: rhbz#2147520
    * Fri Dec  2 2022 Miro Hronok <mhroncok@redhat.com> - 7.3.9-5.3.9
    - On Fedora 37+, obsolete the pypy3.7 package which is no longer available
    * Mon Oct 10 2022 Lumr Balhar <lbalhar@redhat.com> - 7.3.9-4.3.9
    - Backport fix for CVE-2021-28861     Resolves: rhbz#2120789
    * Fri Jul 22 2022 Fedora Release Engineering <releng@fedoraproject.org> - 7.3.9-3.3.9
    - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
    * Tue Jun 28 2022 Charalampos Stratakis <cstratak@redhat.com> - 7.3.9-2.3.9
    - Security fix for CVE-2015-20107
    - Fixes: rhbz#2075390
    * Wed Mar 30 2022 Miro Hronok <mhroncok@redhat.com> - 7.3.9-1.3.9
    - Update to 7.3.9
    - Fixes: rhbz#2069873
    * Tue Mar  1 2022 Miro Hronok <mhroncok@redhat.com> - 7.3.8-1.3.9
    - Include the Python version in Release to workaround debuginfo conflicts       and make same builds of different PyPy sort in a predictable way (e.g. wrt Obsoletes)
    - Namespace the debugsources to fix installation conflict with other PyPys
    - Fixes: rhbz#2053880
    - This is now the main PyPy 3 on Fedora 36+
    - Fixes: rhbz#2059670
    * Tue Feb 22 2022 Miro Hronok <mhroncok@redhat.com> - 7.3.8-1
    - Update to 7.3.8 final
    * Fri Feb 11 2022 Miro Hronok <mhroncok@redhat.com> - 7.3.8~rc2-1
    - Update to 7.3.8rc2
    * Wed Jan 26 2022 Miro Hronok <mhroncok@redhat.com> - 7.3.8~rc1-1
    - Update to 7.3.8rc1
    - Move to a CPython-like installation layout
    - Stop requiring pypy3.9 from pypy3.9-libs
    - Split tests into pypy3.9-test
    * Fri Jan 21 2022 Fedora Release Engineering <releng@fedoraproject.org> - 7.3.7-3
    - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
    * Sat Jan  8 2022 Miro Hronok <mhroncok@redhat.com> - 7.3.7-2
    - Rebuilt for https://fedoraproject.org/wiki/Changes/LIBFFI34
    * Thu Nov 11 2021 Miro Hronok <mhroncok@redhat.com> - 7.3.7-1
    - Initial pypy3.8 package
    - Supplement tox
    * Tue Oct 26 2021 Tom Hrniar <thrnciar@redhat.com> - 7.3.6-1
    - Update to 7.3.6
    - Remove windows executable binaries
    - Fixes: rhbz#2003682
    * Mon Sep 20 2021 Miro Hronok <mhroncok@redhat.com> - 7.3.5-2
    - Explicitly buildrequire OpenSSL 1.1, as Python 3.7 is not compatible with OpenSSL 3.0
    * Mon Aug 16 2021 Miro Hronok <mhroncok@redhat.com> - 7.3.5-1
    - Update to 7.3.5
    - Fixes: rhbz#1992600
    * Mon Aug  9 2021 Tomas Hrnciar <thrnciar@redhat.com> - 7.3.4-4
    - Rename pypy3 to pypy3.7
    - pypy-stackless was removed

    ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5888-1 advisory.

    It was discovered that Python incorrectly handled certain inputs. If a user or an automated system were     tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to     execute arbitrary code. (CVE-2015-20107)

    Hamza Avvan discovered that Python incorrectly handled certain inputs. If a user or an automated system     were tricked into running a specially crafted input, a remote attacker could possibly use this issue to     execute arbitrary code. (CVE-2021-28861)

    It was discovered that Python incorrectly handled certain inputs. If a user or an automated system were     tricked into running a specially crafted input, a remote attacker could possibly use this issue to execute     arbitrary code. (CVE-2022-37454, CVE-2022-42919)

    It was discovered that Python incorrectly handled certain inputs. If a user or an automated system were     tricked into running a specially crafted input, a remote attacker could possibly use this issue to cause a     denial of service. (CVE-2022-45061, CVE-2023-24329)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3980 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-3980-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                          Adrian Bunk     December 02, 2024                             https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : python3.9     Version        : 3.9.2-1+deb11u2     CVE ID         : CVE-2015-20107 CVE-2020-10735 CVE-2021-3426 CVE-2021-3733                      CVE-2021-3737 CVE-2021-4189 CVE-2021-28861 CVE-2021-29921                      CVE-2022-42919 CVE-2022-45061 CVE-2023-6597 CVE-2023-24329                      CVE-2023-27043 CVE-2023-40217 CVE-2024-0397 CVE-2024-0450                      CVE-2024-4032 CVE-2024-6232 CVE-2024-6923 CVE-2024-7592                      CVE-2024-8088 CVE-2024-9287 CVE-2024-11168     Debian Bug     : 989195 1070135 1059298 1070133

    Multiple vulnerabilities have been fixed in the Python3 interpreter.

    CVE-2015-20107

        The mailcap module did not add escape characters into commands         discovered in the system mailcap file

    CVE-2020-10735

        Prevent DoS with very large int

    CVE-2021-3426

        Remove the pydoc getfile feature which could be abused to read         arbitrary files on the disk

    CVE-2021-3733

        Regular Expression Denial of Service in urllib's         AbstractBasicAuthHandler class

    CVE-2021-3737

        Infinite loop in the HTTP client code

    CVE-2021-4189

        Make ftplib not trust the PASV response

    CVE-2021-28861

        Open redirection vulnerability in http.server

    CVE-2021-29921

        Leading zeros in IPv4 addresses are no longer tolerated

    CVE-2022-42919

        Don't use Linux abstract sockets for multiprocessing

    CVE-2022-45061

        Quadratic time in the IDNA decoder

    CVE-2023-6597

        tempfile.TemporaryDirectory failure to remove dir

    CVE-2023-24329

        Strip C0 control and space chars in urlsplit

    CVE-2023-27043

        Reject malformed addresses in email.parseaddr()

    CVE-2023-40217

        ssl.SSLSocket bypass of the TLS handshake

    CVE-2024-0397

        Race condition in ssl.SSLContext

    CVE-2024-0450

        Quoted-overlap zipbomb DoS

    CVE-2024-4032

        Incorrect information about private addresses in the ipaddress         module

    CVE-2024-6232

        ReDoS when parsing tarfile headers

    CVE-2024-6923

        Encode newlines in headers in the email module

    CVE-2024-7592

        Quadratic complexity parsing cookies with backslashes

    CVE-2024-8088

        Infinite loop when iterating over zip archive entry names

    CVE-2024-9287

        venv activation scripts did't quote paths

    CVE-2024-11168

        urllib functions improperly validated bracketed hosts

    For Debian 11 bullseye, these problems have been fixed in version     3.9.2-1+deb11u2.

    We recommend that you upgrade your python3.9 packages.

    For the detailed security status of python3.9 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/python3.9

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
166373	SUSE SLES12 Security Update : python3 (SUSE-SU-2022:3511-2)	Nessus	SuSE Local Security Checks	2022/10/21	2023/7/14	high
165610	SUSE SLES12 Security Update : python36 (SUSE-SU-2022:3483-1)	Nessus	SuSE Local Security Checks	2022/10/1	2023/7/14	high
165691	SUSE SLES12 Security Update : python3 (SUSE-SU-2022:3511-1)	Nessus	SuSE Local Security Checks	2022/10/5	2023/7/14	high
169163	Fedora 35 : pypy3.9 (2022-61d8e8d880)	Nessus	Fedora Local Security Checks	2022/12/22	2024/11/14	high
169170	Fedora 36 : pypy3.9 (2022-4ac2e16969)	Nessus	Fedora Local Security Checks	2022/12/22	2024/11/14	high
169178	Fedora 36 : pypy3.7 (2022-2173709172)	Nessus	Fedora Local Security Checks	2022/12/23	2024/11/14	high
211217	Fedora 37 : pypy3.8 (2022-20116fb6aa)	Nessus	Fedora Local Security Checks	2024/11/14	2024/11/14	high
211341	Fedora 38 : python3.6 (2022-2e93acb55d)	Nessus	Fedora Local Security Checks	2024/11/14	2024/11/14	high
171722	RHEL 8 : python3 (RHSA-2023:0833)	Nessus	Red Hat Local Security Checks	2023/2/21	2025/3/20	high
176305	Oracle Linux 8 : python39:3.9 / and / python39-devel:3.9 (ELSA-2023-2764)	Nessus	Oracle Linux Local Security Checks	2023/5/24	2024/11/2	high
193558	Oracle Business Intelligence Enterprise Edition (OAS 7.0) (April 2024 CPU)	Nessus	Misc.	2024/4/19	2024/4/19	high
167866	AlmaLinux 9 : python3.9 (ALSA-2022:8353)	Nessus	Alma Linux Local Security Checks	2022/11/18	2023/10/3	high
175043	GLSA-202305-02 : Python, PyPy3: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	2023/5/3	2023/5/3	critical
171742	AlmaLinux 8 : python3 (ALSA-2023:0833)	Nessus	Alma Linux Local Security Checks	2023/2/21	2023/9/1	high
185177	Fedora 39 : pypy3.10 (2023-ddde191e04)	Nessus	Fedora Local Security Checks	2023/11/7	2024/11/14	high
171939	Ubuntu 20.04 ESM : Python vulnerabilities (USN-5888-1)	Nessus	Ubuntu Local Security Checks	2023/2/28	2024/8/27	critical
211991	Debian dla-3980 : idle-python3.9 - security update	Nessus	Debian Local Security Checks	2024/12/2	2024/12/2	high

偵測

搜尋 Plugin

high

high

high

high

high

high

high

high

high

high

high

high

critical

high

high

critical

high