EulerOS 2.0 SP15 : python3 (EulerOS-SA-2026-3946)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(364010);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/08");

  script_cve_id(
    "CVE-2025-15366",
    "CVE-2026-0864",
    "CVE-2026-3276",
    "CVE-2026-3446",
    "CVE-2026-4360",
    "CVE-2026-7210",
    "CVE-2026-8328",
    "CVE-2026-11940",
    "CVE-2026-11972",
    "CVE-2026-12003",
    "CVE-2026-15308"
  );

  script_name(english:"EulerOS 2.0 SP15 : python3 (EulerOS-SA-2026-3946)");

  script_set_attribute(attribute:"synopsis", value:
"The remote EulerOS host is missing multiple security updates.");
  script_set_attribute(attribute:"description", value:
"According to the versions of the python3 packages installed, the EulerOS installation on the remote host is affected by
the following vulnerabilities :

    unicodedata.normalize() can take excessive CPU time when processing_x000D_
    specially crafted Unicode input containing long runs of combining characters_x000D_
    with alternating Canonical Combining Class values._x000D_
    This affects all normalization forms.(CVE-2026-3276)

    tarfile.extractall() with the 'data' or 'tar' filter could be bypassed by a crafted archive where a
    hardlink references a symlink stored at a deeper name than the hardlink itself. The extraction fallback
    validated the symlink at its archived location but recreated it at the hardlink's shallower path, letting
    a relative target the filter judged contained escape the destination directory. This allowed a malicious
    tar archive to create a symlink pointing outside the destination, enabling out-of-destination file reads
    or writes. This was an incomplete fix of CVE-2025-4330.(CVE-2026-11940)

    When calling base64.b64decode() or related functions the decoding process would stop after encountering
    the first padded quad regardless of whether there was more information to be processed. This can lead to
    data being accepted which may be processed differently by other implementations. Use 'validate=True' to
    enable stricter processing of base64 data.(CVE-2026-3446)

    In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks.
    An affected system that extracts content from untrusted tar files could end up writing files with an
    unexpected uid/gid despite the user passing filter='data' to the extract() function.(CVE-2026-4360)

    The imaplib module, when passed a user-controlled command, can have additional commands injected using
    newlines. Mitigation rejects commands containing control characters.(CVE-2025-15366)

    To allow builds of Python to be run from an in-tree layout (rather than_x000D_
    an installed file layout), the VPATH variable is defined at build time_x000D_
    and used to locate certain landmarks - specifically,_x000D_
    Modules/setup.local. When this landmark is found relative to VPATH_x000D_
    relative to the executable, Python assumes it is running in a source_x000D_
    tree and generates a different default sys.path. This code remains in_x000D_
    release builds, so that release-ready builds can be built in-tree._x000D_
    _x000D_
    On Windows, since builds are written to 'PCbuild/', the value of_x000D_
    VPATH is set to '..\..', which results in a landmark of_x000D_
    '..\..\Modules\setup.local'. This path is outside the install directory_x000D_
    of Python, and may have different permissions, potentially allowing a_x000D_
    low-privilege user to create the landmark and an alternative `Lib`_x000D_
    folder that will be discovered by an otherwise restricted install._x000D_
    _x000D_
    Such a setup occurs with the legacy default install location for all_x000D_
    users (in the now superseded EXE installer), due to how Windows allows_x000D_
    all users to create folders in the root directory of their OS drive._x000D_
    _x000D_
    Our recommended mitigation on Windows is to migrate away from the_x000D_
    legacy installer and use the new [Python install_x000D_
    manager](https://www.python.org/downloads/latest/pymanager/) to install_x000D_
    for the current user. Installs where the directory two levels above the_x000D_
    Python installation directory have equivalent permissions are unaffected_x000D_
    (in general, a per-user install cannot be modified at all by other_x000D_
    users, removing any escalation of privilege risk, and could be directly_x000D_
    modified by a privileged user, making the potential tampering_x000D_
    irrelevant). Alternative mitigations might include preemptively creating_x000D_
    and restricting access to a `Modules` directory. Be aware that only 3.13_x000D_
    and 3.14 will receive updated legacy installers - earlier fixes are only_x000D_
    provided as sources._x000D_
    _x000D_
    Platforms other than Windows allow VPATH to be overridden, but as they_x000D_
    don't usually use a separated directory in the build for binaries, are_x000D_
    unlikely to have a landmark reference outside of the install directory._x000D_
    _x000D_
    The landmark detection involving VPATH is a fallback for when a more_x000D_
    specific landmark - .\pybuilddir.txt - is absent, and was included for_x000D_
    compatibility. Future releases of Python will no longer include the_x000D_
    fallback, and so builds will need to generate or preserve the_x000D_
    pybuilddir.txt file in order to work in-tree. This landmark file has_x000D_
    been generated on Windows since 3.11, and on other platforms for longer.(CVE-2026-12003)

    `xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding
    protection, which allows a crafted XML document to trigger hash flooding.\r\n\r\nFully mitigating this
    vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch.(CVE-2026-7210)

    When using the 'configparser' module to write configuration files_x000D_
    containing multi-line text values with carriage return characters (\r) the_x000D_
    resulting file could be injected with unexpected keys and values if the_x000D_
    attacker controls the written value.(CVE-2026-0864)

    When using the 'tarfile' module with a file opened in 'streaming mode' (mode='r|') the tarfile module did
    not properly handle EOF, making archive parsing take exponentially longer.(CVE-2026-11972)

    The Oracle Solaris Third Party Bulletin announces patches for one or more security vulnerabilities
    addressed in third party software that is included in Oracle Solaris distributions. Starting January 20,
    2015, Third Party Bulletins are released on the same day when Oracle Critical Patch Updates are released.
    These bulletins will also be updated after their release between the quarterly Critical Patch Updates. In
    addition, Third Party Bulletins may also be updated for vulnerability issues deemed too critical to wait
    for the next monthly update.(CVE-2026-8328)

    The incremental HTML parser (html.parser.HTMLParser) allows for CPU_x000D_
    denial-of-service through repeated unterminated markup declarations when_x000D_
    processing uncontrolled data.(CVE-2026-15308)

Tenable has extracted the preceding description block directly from the EulerOS python3 security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2026-3946
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?658faf87");
  script_set_attribute(attribute:"solution", value:
"Update the affected python3 packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:U");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-4360");
  script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2026-0864");
  script_set_attribute(attribute:"cvss4_score_source", value:"CVE-2026-15308");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/01/20");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/10/08");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/08");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:python3");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:python3-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:python3-fgo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:python3-help");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:python3-unversioned-command");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:huawei:euleros:2.0");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Huawei Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/EulerOS/release", "Host/EulerOS/rpm-list", "Host/EulerOS/sp");
  script_exclude_keys("Host/EulerOS/uvp_version");

  exit(0);
}

include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);

var _release = get_kb_item("Host/EulerOS/release");
if (isnull(_release) || _release !~ "^EulerOS") audit(AUDIT_OS_NOT, "EulerOS");
var uvp = get_kb_item("Host/EulerOS/uvp_version");
if (_release !~ "^EulerOS release 2\.0(\D|$)") audit(AUDIT_OS_NOT, "EulerOS 2.0 SP15");

var sp = get_kb_item("Host/EulerOS/sp");
if (isnull(sp) || sp !~ "^(15)$") audit(AUDIT_OS_NOT, "EulerOS 2.0 SP15");

if (!empty_or_null(uvp)) audit(AUDIT_OS_NOT, "EulerOS 2.0 SP15", "EulerOS UVP " + uvp);

if (!get_kb_item("Host/EulerOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "aarch64" >!< cpu && "x86" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "EulerOS", cpu);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "x86" >!< cpu) audit(AUDIT_ARCH_NOT, "i686 / x86_64", cpu);

var flag = 0;

var pkgs = [
  "python3-3.11.6-10.h21510.31.eulerosv2r15",
  "python3-devel-3.11.6-10.h21510.31.eulerosv2r15",
  "python3-fgo-3.11.6-10.h21510.31.eulerosv2r15",
  "python3-help-3.11.6-10.h21510.31.eulerosv2r15",
  "python3-unversioned-command-3.11.6-10.h21510.31.eulerosv2r15"
];

foreach (var pkg in pkgs)
  if (rpm_check(release:"EulerOS-2.0", sp:"15", reference:pkg)) flag++;

if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_WARNING,
    extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "python3");
}