There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - There is a defect in the CPython standard library module “mimetypes” where on Windows the default list of
    known file locations are writable meaning other users can create invalid files to cause MemoryError to be
    raised on Python runtime startup or have file extensions be interpreted as the incorrect file type. This
    defect is caused by the default locations of Linux and macOS platforms (such as “/etc/mime.types”) also
    being used on Windows, where they are user-writable locations (“C:\etc\mime.types”). To work-around this
    issue a user can call mimetypes.init() with an empty list (“[]”) on Windows platforms to avoid using the
    default list of known file locations. (CVE-2024-3220)

  - tarfile.tar_filter could be bypassed using crafted link entries, including symlinks with empty or
    directory-like names, to redirect later archive members outside the intended extraction directory. This
    allowed a malicious tar archive to cause tarfile.extractall() with filter="tar" to write files outside the
    destination directory, subject to the permissions of the extracting process. This is the
    tarfile.tar_filter counterpart of CVE-2026-7774, which covered tarfile.data_filter. (CVE-2026-114583)

  - Python has added a denylist for known compromised certificates to the "ssl" module to ensure user safety
    even without certificate revocation configured. Known compromised certificates will automatically be
    rejected regardless of the SSLContext policy configuration. (CVE-2026-115557)

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Python has added a denylist for known compromised certificates to the "ssl" module to ensure user safety
    even without certificate revocation configured. Known compromised certificates will automatically be
    rejected regardless of the SSLContext policy configuration. (CVE-2026-115557)

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且廠商未提供可用的修補程式。

  - Python 已將已知受損憑證的拒絕清單新增至 ssl 模組，以確保即使未設定憑證撤銷，也能確保使用者安全。無論 SSLContext 原則設定為何，已知的已入侵憑證都會被自動拒絕。（CVE-2026-115557）

請注意，Nessus 的判定取決於廠商所報告的套件是否存在。

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - Python 已将已知受影响证书的拒绝列表添加到 ssl 模块，以确保即使未配置证书吊销也能确保用户安全。无论 SSLContext 策略配置如何，都将自动拒绝已知的已破坏证书。（CVE-2026-115557）

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - Python は、証明書失効が構成されていなくてもユーザーの安全を確保するために、既知の危険にさらされている証明書の拒否リストを ssl モジュールに追加しました。SSLContext ポリシーの構成に関わらず、既知のセキュリティを危険にさらしている証明書は自動的に拒否されます。(CVE-2026-115557)

Nessus は、ベンダーから報告されたパッケージの存在に依存していることに注意してください。

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Python has added a denylist for known compromised certificates to the ssl module to ensure user safety     even without certificate revocation configured. Known compromised certificates will automatically be     rejected regardless of the SSLContext policy configuration. (CVE-2026-115557)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of Python installed on the remote Windows host is prior to 3.11.18, or is 3.12.x prior to 3.12.16, or 3.13.x prior to 3.13.18, or 3.14.x prior to 3.14.10, or 3.15.x prior to 3.15.2, or 3.16.x prior to 3.16.0. It is, therefore, affected by multiple vulnerabilities:

  - tarfile.tar_filter could be bypassed using crafted link entries, including symlinks with empty or     directory-like names, to redirect later archive members outside the intended extraction directory. This     allowed a malicious tar archive to cause tarfile.extractall() with the 'tar' filter to write files outside     the destination directory, subject to the permissions of the extracting process. (CVE-2026-114583)

  - Python has added a denylist for known compromised certificates to the 'ssl' module to ensure user safety     even without certificate revocation configured. Known compromised certificates will automatically be     rejected regardless of the SSLContext policy configuration. (CVE-2026-115557)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
477711	Alpine: multiple pyc packages: security update to 3.12.16-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	2026/10/28	2026/10/28	critical
477711	Alpine: multiple pyc packages: security update to 3.12.16-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	2026/10/28	2026/10/28	critical
477710	Echo: python3.13: security update to 3.13.5-2+e42	Tenable Cloud Security	Echo Local Security Checks	2026/10/28	2026/10/28	critical
477710	Echo: python3.13: security update to 3.13.5-2+e42	Tenable Self-Hosted Container Security	Echo Local Security Checks	2026/10/28	2026/10/28	critical
371815	Linux Distros 未修補弱點：CVE-2026-115557	Nessus	Misc.	2026/10/24	2026/10/27	critical
371815	Linux Distros 未修补的漏洞：CVE-2026-115557	Nessus	Misc.	2026/10/24	2026/10/27	critical
371815	Linux Distros のパッチ未適用の脆弱性: CVE-2026-115557	Nessus	Misc.	2026/10/24	2026/10/27	critical
371815	Linux Distros Unpatched Vulnerability : CVE-2026-115557	Nessus	Misc.	2026/10/24	2026/10/27	critical
373609	Python < 3.11.18 / 3.12.x < 3.12.16 / 3.13.x < 3.13.18 / 3.14.x < 3.14.10 / 3.15.x < 3.15.2 / 3.16.x < 3.16.0 Multiple Vulnerabilities	Nessus	Windows	2026/10/29	2026/10/29	critical

偵測

搜尋 Plugin

critical

critical

critical

critical

critical

critical

critical

critical

critical