EulerOS Virtualization 2.11.0 : python-pip (EulerOS-SA-2026-3551)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(347276);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/09/18");

  script_cve_id(
    "CVE-2023-32681",
    "CVE-2024-47081",
    "CVE-2025-8869",
    "CVE-2025-50181",
    "CVE-2025-66418",
    "CVE-2026-1703",
    "CVE-2026-3219",
    "CVE-2026-8643",
    "CVE-2026-21441",
    "CVE-2026-25645",
    "CVE-2026-44431"
  );

  script_name(english:"EulerOS Virtualization 2.11.0 : python-pip (EulerOS-SA-2026-3551)");

  script_set_attribute(attribute:"synopsis", value:
"The remote EulerOS Virtualization host is missing multiple security updates.");
  script_set_attribute(attribute:"description", value:
"According to the versions of the python-pip packages installed, the EulerOS Virtualization installation on the remote
host is affected by the following vulnerabilities :

    Requests is a HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc
    credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4
    to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with
    `trust_env=False` on one's Requests Session.(CVE-2024-47081)

    Requests is a HTTP library. Since Requests 2.3.0, Requests has been leaking Proxy-Authorization headers to
    destination servers when redirected to an HTTPS endpoint. This is a product of how we use
    `rebuild_proxies` to reattach the `Proxy-Authorization` header to requests. For HTTP connections sent
    through the tunnel, the proxy will identify the header in the request itself and remove it prior to
    forwarding to the destination server. However when sent over HTTPS, the `Proxy-Authorization` header must
    be sent in the CONNECT request as the proxy has no visibility into the tunneled request. This results in
    Requests forwarding proxy credentials to the destination server unintentionally, allowing a malicious
    actor to potentially exfiltrate sensitive information. This issue has been patched in version
    2.31.0.(CVE-2023-32681)

    urllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, it is possible to disable
    redirects for all requests by instantiating a PoolManager and specifying retries in a way that disable
    redirects. By default, requests and botocore users are not affected. An application attempting to mitigate
    SSRF or open redirect vulnerabilities by disabling redirects at the PoolManager level will remain
    vulnerable. This issue has been patched in version 2.5.0.(CVE-2025-50181)

    When extracting a tar archive pip may not check symbolic links point into the extraction directory if the
    tarfile module doesn't implement PEP 706.Note that upgrading pip to a 'fixed' version for this
    vulnerability doesn't fix all known vulnerabilities that are remediated by using a Python version that
    implements PEP 706.Note that this is a vulnerability in pip's fallback implementation of tar extraction
    for Python versions that don't implement PEP 706 and therefore are not secure to all vulnerabilities in
    the Python 'tarfile' module. If you're using a Python version that implements PEP 706 then pip doesn't use
    the 'vulnerable' fallback code.Mitigations include upgrading to a version of pip that includes the fix,
    upgrading to a Python version that implements PEP 706 (Python =3.9.17, =3.10.12, =3.11.4, or
    =3.12),applying the linked patch, or inspecting source distributions (sdists) before installation as is
    already a best-practice.(CVE-2025-8869)

    urllib3 is an HTTP client library for Python. urllib3's streaming API is designed for the efficient
    handling of large HTTP responses by reading the content in chunks, rather than loading the entire response
    body into memory at once. urllib3 can perform decoding or decompression based on the HTTP `Content-
    Encoding` header (e.g., `gzip`, `deflate`, `br`, or `zstd`). When using the streaming API, the library
    decompresses only the necessary bytes, enabling partial content consumption. Starting in version 1.22 and
    prior to version 2.6.3, for HTTP redirect responses, the library would read the entire response body to
    drain the connection and decompress the content unnecessarily. This decompression occurred even before any
    read methods were called, and configured read limits did not restrict the amount of decompressed data. As
    a result, there was no safeguard against decompression bombs. A malicious server could exploit this to
    trigger excessive resource consumption on the client. Applications and libraries are affected when they
    stream content from untrusted sources by setting `preload_content=False` when they do not disable
    redirects. Users should upgrade to at least urllib3 v2.6.3, in which the library does not decode content
    of redirect responses when `preload_content=False`. If upgrading is not immediately possible, disable
    redirects by setting `redirect=False` for requests to untrusted source.(CVE-2026-21441)

    urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.24 and prior to 2.6.0,
    the number of links in the decompression chain was unbounded allowing a malicious server to insert a
    virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation
    for the decompressed data. This vulnerability is fixed in 2.6.0.(CVE-2025-66418)

    pip would treat console_scripts and gui_scripts as paths instead of file names without sanitizing the
    resolved absolute path to the installation directory, leading to entry points being installed outside the
    installation directory.(CVE-2026-8643)

    pip handles concatenated tar and ZIP files as ZIP files regardless of filename or whether a file is both a
    tar and ZIP file. This behavior could result in confusing installation behavior, such as installing
    'incorrect' files according to the filename of the archive. New behavior only proceeds with installation
    if the file identifies uniquely as a ZIP or tar archive, not as both.(CVE-2026-3219)

    Requests is a HTTP library. Prior to version 2.33.0, the `requests.utils.extract_zipped_paths()` utility
    function uses a predictable filename when extracting files from zip archives into the system temporary
    directory. If the target file already exists, it is reused without validation. A local attacker with write
    access to the temp directory could pre-create a malicious file that would be loaded in place of the
    legitimate one. Standard usage of the Requests library is not affected by this vulnerability. Only
    applications that call `extract_zipped_paths()` directly are impacted. Starting in version 2.33.0, the
    library extracts files to a non-deterministic location. If developers are unable to upgrade, they can set
    `TMPDIR` in their environment to a directory with restricted write access.(CVE-2026-25645)

    When pip is installing and extracting a maliciously crafted wheel archive, files may be extracted outside
    the installation directory. The path traversal is limited to prefixes of the installation directory, thus
    isn't able to inject or overwrite executable files in typical situations.(CVE-2026-1703)

    urllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin redirects followed
    from the low-level API via ProxyManager.connection_from_url().urlopen(..., assert_same_host=False) still
    forward these sensitive headers. This vulnerability is fixed in 2.7.0.(CVE-2026-44431)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization python-pip security
advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2026-3551
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?2bcb8cdd");
  script_set_attribute(attribute:"solution", value:
"Update the affected python-pip packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:P");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-50181");
  script_set_attribute(attribute:"cvss4_score_source", value:"CVE-2026-21441");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2023/05/22");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/09/16");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/09/18");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:python-pip-wheel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:python3-pip");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:huawei:euleros:uvp:2.11.0");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Huawei Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/EulerOS/release", "Host/EulerOS/rpm-list", "Host/EulerOS/uvp_version");

  exit(0);
}

include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);

var _release = get_kb_item("Host/EulerOS/release");
if (isnull(_release) || _release !~ "^EulerOS") audit(AUDIT_OS_NOT, "EulerOS");
var uvp = get_kb_item("Host/EulerOS/uvp_version");
if (uvp != "2.11.0") audit(AUDIT_OS_NOT, "EulerOS Virtualization 2.11.0");
if (!get_kb_item("Host/EulerOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "aarch64" >!< cpu && "x86" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "EulerOS", cpu);

var flag = 0;

var pkgs = [
  "python-pip-wheel-21.3.1-1.h15.eulerosv2r11",
  "python3-pip-21.3.1-1.h15.eulerosv2r11"
];

foreach (var pkg in pkgs)
  if (rpm_check(release:"EulerOS-2.0", reference:pkg)) flag++;

if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_WARNING,
    extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "python-pip");
}