EulerOS Virtualization 2.13.1 : python3 (EulerOS-SA-2026-2149)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(319467);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/06/06");

  script_cve_id(
    "CVE-2024-5642",
    "CVE-2025-6075",
    "CVE-2025-8291",
    "CVE-2025-12084",
    "CVE-2025-13836",
    "CVE-2025-13837",
    "CVE-2026-0672",
    "CVE-2026-1299"
  );

  script_name(english:"EulerOS Virtualization 2.13.1 : python3 (EulerOS-SA-2026-2149)");

  script_set_attribute(attribute:"synopsis", value:
"The remote EulerOS Virtualization host is missing multiple security updates.");
  script_set_attribute(attribute:"description", value:
"According to the versions of the python3 packages installed, the EulerOS Virtualization installation on the remote host
is affected by the following vulnerabilities :

    If the value passed to os.path.expandvars() is user-controlled a performance degradation is possible when
    expanding environment variables.(CVE-2025-6075)

    When reading an HTTP response from a server, if no read amount is specified, the default behavior will be
    to use Content-Length. This allows a malicious server to cause the client to read large amounts of data
    into memory, potentially causing OOM or other DoS.(CVE-2025-13836)

    When building nested elements using xml.dom.minidom methods such as appendChild() that have a dependency
    on _clear_id_cache() the algorithm is quadratic. Availability can be impacted when building excessively
    nested documents.(CVE-2025-12084)

    The 'zipfile' module would not check the validity of the ZIP64 End of Central Directory (EOCD) Locator
    record offset value would not be used to locate the ZIP64 EOCD record, instead the ZIP64 EOCD record would
    be assumed to be the previous record in the ZIP archive. This could be abused to create ZIP archives that
    are handled differently by the 'zipfile' module compared to other ZIP implementations.Remediation
    maintains this behavior, but checks that the offset specified in the ZIP64 EOCD Locator record matches the
    expected value.(CVE-2025-8291)

    CPython 3.9 and earlier doesn't disallow configuring an empty list ('[]') for
    SSLContext.set_npn_protocols() which is an invalid value for the underlying OpenSSL API. This results in a
    buffer over-read when NPN is used (see CVE-2024-5535 for OpenSSL). This vulnerability is of low severity
    due to NPN being not widely used and specifying an empty list likely being uncommon in-practice (typically
    a protocol name would be configured).(CVE-2024-5642)

    When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a
    malicious file can cause OOM and DoS issues(CVE-2025-13837)

    The
    email module, specifically the 'BytesGenerator' class, didn't properly quote newlines for email headers
    when serializing an email message allowing for header injection when an email  is serialized. This is only
    applicable if using 'LiteralHeader' writing headers that don't respect email folding rules, the new
    behavior will reject the incorrectly folded headers in 'BytesGenerator'.(CVE-2026-1299)

    When using http.cookies.Morsel, user-controlled cookie values and parameters can allow injecting HTTP
    headers into messages. Patch rejects all control characters within cookie names, values, and
    parameters.(CVE-2026-0672)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization python3 security
advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2026-2149
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?3c6a1999");
  script_set_attribute(attribute:"solution", value:
"Update the affected python3 packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:U");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-13836");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2024/06/27");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/06/02");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/06/06");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:python3");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:python3-fgo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:python3-unversioned-command");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:huawei:euleros:uvp:2.13.1");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Huawei Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/EulerOS/release", "Host/EulerOS/rpm-list", "Host/EulerOS/uvp_version");

  exit(0);
}

include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);

var _release = get_kb_item("Host/EulerOS/release");
if (isnull(_release) || _release !~ "^EulerOS") audit(AUDIT_OS_NOT, "EulerOS");
var uvp = get_kb_item("Host/EulerOS/uvp_version");
if (uvp != "2.13.1") audit(AUDIT_OS_NOT, "EulerOS Virtualization 2.13.1");
if (!get_kb_item("Host/EulerOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "aarch64" >!< cpu && "x86" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "EulerOS", cpu);
if ("aarch64" >!< cpu) audit(AUDIT_ARCH_NOT, "aarch64", cpu);

var flag = 0;

var pkgs = [
  "python3-3.9.9-28.h21.eulerosv2r13",
  "python3-fgo-3.9.9-28.h21.eulerosv2r13",
  "python3-unversioned-command-3.9.9-28.h21.eulerosv2r13"
];

foreach (var pkg in pkgs)
  if (rpm_check(release:"EulerOS-2.0", reference:pkg)) flag++;

if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_HOLE,
    extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "python3");
}