Amazon Linux 2023 : python3.11, python3.11-devel, python3.11-idle (ALAS2023-2025-1045)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Amazon Linux 2023 Security Advisory ALAS2023-2025-1045.
##

include('compat.inc');

if (description)
{
  script_id(240311);
  script_version("1.5");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/02/24");

  script_cve_id(
    "CVE-2024-12718",
    "CVE-2025-4138",
    "CVE-2025-4330",
    "CVE-2025-4435",
    "CVE-2025-4517"
  );
  script_xref(name:"IAVA", value:"2025-A-0444-S");

  script_name(english:"Amazon Linux 2023 : python3.11, python3.11-devel, python3.11-idle (ALAS2023-2025-1045)");

  script_set_attribute(attribute:"synopsis", value:
"The remote Amazon Linux 2023 host is missing a security update.");
  script_set_attribute(attribute:"description", value:
"It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1045 advisory.

    Allows modifying some file metadata (e.g. last modified) with filter=data or file permissions (chmod)
    with filter=tar of files outside the extraction directory.You are affected by this vulnerability if
    using the tarfile module to extract untrusted tar archives using TarFile.extractall() or TarFile.extract()
    using the filter= parameter with a value of data or tar. See the tarfile  extraction filters
    documentation https://docs.python.org/3/library/tarfile.html#tarfile-extraction-filter  for more
    information. Only Python versions 3.12 or later are affected by these vulnerabilities, earlier versions
    don't include the extraction filter feature.

    Note that for Python 3.14 or later the default value of filter= changed from no filtering to `data, so
    if you are relying on this new default behavior then your usage is also affected.

    Note that none of these vulnerabilities significantly affect the installation of source distributions
    which are tar archives as source distributions already allow arbitrary code execution during the build
    process. However when evaluating source distributions it's important to avoid installing source
    distributions with suspicious links. (CVE-2024-12718)

    Allows the extraction filter to be ignored, allowing symlink targets to point outside the destination
    directory, and the modification of some file metadata.

    You are affected by this vulnerability if using the tarfile module to extract untrusted tar archives using
    TarFile.extractall() or TarFile.extract() using the filter= parameter with a value of data or tar. See
    the tarfile  extraction filters documentation https://docs.python.org/3/library/tarfile.html#tarfile-
    extraction-filter  for more information.

    Note that for Python 3.14 or later the default value of filter= changed from no filtering to `data, so
    if you are relying on this new default behavior then your usage is also affected.

    Note that none of these vulnerabilities significantly affect the installation of source distributions
    which are tar archives as source distributions already allow arbitrary code execution during the build
    process. However when evaluating source distributions it's important to avoid installing source
    distributions with suspicious links. (CVE-2025-4138)

    Allows the extraction filter to be ignored, allowing symlink targets to point outside the destination
    directory, and the modification of some file metadata.

    You are affected by this vulnerability if using the tarfile module to extract untrusted tar archives using
    TarFile.extractall() or TarFile.extract() using the filter= parameter with a value of data or tar. See
    the tarfile  extraction filters documentation https://docs.python.org/3/library/tarfile.html#tarfile-
    extraction-filter  for more information.

    Note that for Python 3.14 or later the default value of filter= changed from no filtering to `data, so
    if you are relying on this new default behavior then your usage is also affected.

    Note that none of these vulnerabilities significantly affect the installation of source distributions
    which are tar archives as source distributions already allow arbitrary code execution during the build
    process. However when evaluating source distributions it's important to avoid installing source
    distributions with suspicious links. (CVE-2025-4330)

    When using a TarFile.errorlevel = 0 and extracting with a filter the documented behavior is that any
    filtered members would be skipped and not extracted. However the actual behavior of TarFile.errorlevel = 0
    in affected versions is that the member would still be extracted and not skipped. (CVE-2025-4435)

    Allows arbitrary filesystem writes outside the extraction directory during extraction with filter=data.

    You are affected by this vulnerability if using the tarfile module to extract untrusted tar archives using
    TarFile.extractall() or TarFile.extract() using the filter= parameter with a value of data or tar. See
    the tarfile  extraction filters documentation https://docs.python.org/3/library/tarfile.html#tarfile-
    extraction-filter  for more information. Only Python versions 3.12 or later are affected by these
    vulnerabilities, earlier versions don't include the extraction filter feature.

    Note that for Python 3.14 or later the default value of filter= changed from no filtering to `data, so
    if you are relying on this new default behavior then your usage is also affected.

    Note that none of these vulnerabilities significantly affect the installation of source distributions
    which are tar archives as source distributions already allow arbitrary code execution during the build
    process. However when evaluating source distributions it's important to avoid installing source
    distributions with suspicious links. (CVE-2025-4517)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://alas.aws.amazon.com/AL2023/ALAS-2025-1045.html");
  script_set_attribute(attribute:"see_also", value:"https://alas.aws.amazon.com/cve/html/CVE-2024-12718.html");
  script_set_attribute(attribute:"see_also", value:"https://alas.aws.amazon.com/cve/html/CVE-2025-4138.html");
  script_set_attribute(attribute:"see_also", value:"https://alas.aws.amazon.com/cve/html/CVE-2025-4330.html");
  script_set_attribute(attribute:"see_also", value:"https://alas.aws.amazon.com/cve/html/CVE-2025-4435.html");
  script_set_attribute(attribute:"see_also", value:"https://alas.aws.amazon.com/cve/html/CVE-2025-4517.html");
  script_set_attribute(attribute:"see_also", value:"https://alas.aws.amazon.com/faqs.html");
  script_set_attribute(attribute:"solution", value:
"Run 'dnf update python3.11 --releasever 2023.7.20250623' to update your system.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:U");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-4517");
  script_set_attribute(attribute:"cvss4_score_source", value:"CVE-2024-12718");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/06/03");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/06/23");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/06/23");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:python3.11");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:python3.11-debug");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:python3.11-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:python3.11-debugsource");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:python3.11-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:python3.11-idle");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:python3.11-libs");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:python3.11-test");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:python3.11-tkinter");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:amazon:linux:2023");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Amazon Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2025-2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/AmazonLinux/release", "Host/AmazonLinux/rpm-list");

  exit(0);
}

include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);

var alas_release = get_kb_item("Host/AmazonLinux/release");
if (isnull(alas_release) || !strlen(alas_release)) audit(AUDIT_OS_NOT, "Amazon Linux");
var os_ver = pregmatch(pattern: "^AL(A|\d+|-\d+)", string:alas_release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Amazon Linux");
os_ver = os_ver[1];
if (os_ver != "-2023")
{
  if (os_ver == 'A') os_ver = 'AMI';
  audit(AUDIT_OS_NOT, "Amazon Linux 2023", "Amazon Linux " + os_ver);
}

if (!get_kb_item("Host/AmazonLinux/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

var pkgs = [
    {'reference':'python3.11-3.11.13-1.amzn2023.0.1', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'python3.11-3.11.13-1.amzn2023.0.1', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'python3.11-debug-3.11.13-1.amzn2023.0.1', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'python3.11-debug-3.11.13-1.amzn2023.0.1', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'python3.11-debuginfo-3.11.13-1.amzn2023.0.1', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'python3.11-debuginfo-3.11.13-1.amzn2023.0.1', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'python3.11-debugsource-3.11.13-1.amzn2023.0.1', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'python3.11-debugsource-3.11.13-1.amzn2023.0.1', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'python3.11-devel-3.11.13-1.amzn2023.0.1', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'python3.11-devel-3.11.13-1.amzn2023.0.1', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'python3.11-idle-3.11.13-1.amzn2023.0.1', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'python3.11-idle-3.11.13-1.amzn2023.0.1', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'python3.11-libs-3.11.13-1.amzn2023.0.1', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'python3.11-libs-3.11.13-1.amzn2023.0.1', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'python3.11-test-3.11.13-1.amzn2023.0.1', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'python3.11-test-3.11.13-1.amzn2023.0.1', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'python3.11-tkinter-3.11.13-1.amzn2023.0.1', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'python3.11-tkinter-3.11.13-1.amzn2023.0.1', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE}
];

var flag = 0;
foreach var package_array ( pkgs ) {
  var reference = NULL;
  var _release = NULL;
  var sp = NULL;
  var _cpu = NULL;
  var el_string = NULL;
  var rpm_spec_vers_cmp = NULL;
  var epoch = NULL;
  var allowmaj = NULL;
  var exists_check = NULL;
  var cves = NULL;
  if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];
  if (!empty_or_null(package_array['release'])) _release = package_array['release'];
  if (!empty_or_null(package_array['sp'])) sp = package_array['sp'];
  if (!empty_or_null(package_array['cpu'])) _cpu = package_array['cpu'];
  if (!empty_or_null(package_array['el_string'])) el_string = package_array['el_string'];
  if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];
  if (!empty_or_null(package_array['epoch'])) epoch = package_array['epoch'];
  if (!empty_or_null(package_array['allowmaj'])) allowmaj = package_array['allowmaj'];
  if (!empty_or_null(package_array['exists_check'])) exists_check = package_array['exists_check'];
  if (!empty_or_null(package_array['cves'])) cves = package_array['cves'];
  if (reference && _release && (!exists_check || rpm_exists(release:_release, rpm:exists_check))) {
    if (rpm_check(release:_release, sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}

if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "python3.11 / python3.11-debug / python3.11-debuginfo / etc");
}