MiracleLinux 7 : python3-3.6.8-21.0.5.0.2.el7.AXS7 (AXSA:2025-11111:08)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The package checks in this plugin were extracted from
# Miracle Linux Security Advisory AXSA:2025-11111:08.
##

include('deprecated_nasl_level.inc');
include('compat.inc');

if (description)
{
  script_id(283218);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/02/24");

  script_cve_id(
    "CVE-2024-12718",
    "CVE-2025-4138",
    "CVE-2025-4330",
    "CVE-2025-4435",
    "CVE-2025-4517"
  );
  script_xref(name:"IAVA", value:"2025-A-0444-S");

  script_name(english:"MiracleLinux 7 : python3-3.6.8-21.0.5.0.2.el7.AXS7 (AXSA:2025-11111:08)");

  script_set_attribute(attribute:"synopsis", value:
"The remote MiracleLinux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the
AXSA:2025-11111:08 advisory.

    * CVE-2024-12718, CVE-2025-4138, CVE-2025-4330, CVE-2025-4435, CVE-2025-4517:
    fix multiple tarfile extraction filter bypasses (filter=tar/filter=data)
    CVE(s):
    CVE-2025-4435
    When using a TarFile.errorlevel = 0 and extracting with a filter the documented behavior is that any
    filtered members would be skipped and not extracted. However the actual behavior of TarFile.errorlevel = 0
    in affected versions is that the member would still be extracted and not skipped.
    CVE-2024-12718
    Allows modifying some file metadata (e.g. last modified) with filter=data or file permissions (chmod)
    with filter=tar of files outside the extraction directory. You are affected by this vulnerability if
    using the tarfile module to extract untrusted tar archives using TarFile.extractall() or TarFile.extract()
    using the filter= parameter with a value of data or tar. See the tarfile extraction filters
    documentation https://docs.python.org/3/library/tarfile.html#tarfile-extraction-filter  for more
    information. Only Python versions 3.12 or later are affected by these vulnerabilities, earlier versions
    don't include the extraction filter feature. Note that for Python 3.14 or later the default value of
    filter= changed from no filtering to `data, so if you are relying on this new default behavior then
    your usage is also affected. Note that none of these vulnerabilities significantly affect the installation
    of source distributions which are tar archives as source distributions already allow arbitrary code
    execution during the build process. However when evaluating source distributions it's important to avoid
    installing source distributions with suspicious links.
    CVE-2025-4517
    Allows arbitrary filesystem writes outside the extraction directory during extraction with filter=data.
    You are affected by this vulnerability if using the tarfile module to extract untrusted tar archives using
    TarFile.extractall() or TarFile.extract() using the filter= parameter with a value of data or tar. See
    the tarfile extraction filters documentation https://docs.python.org/3/library/tarfile.html#tarfile-
    extraction-filter  for more information. Note that for Python 3.14 or later the default value of filter=
    changed from no filtering to `data, so if you are relying on this new default behavior then your usage
    is also affected. Note that none of these vulnerabilities significantly affect the installation of source
    distributions which are tar archives as source distributions already allow arbitrary code execution during
    the build process. However when evaluating source distributions it's important to avoid installing source
    distributions with suspicious links.
    CVE-2025-4330
    Allows the extraction filter to be ignored, allowing symlink targets to point outside the destination
    directory, and the modification of some file metadata. You are affected by this vulnerability if using the
    tarfile module to extract untrusted tar archives using TarFile.extractall() or TarFile.extract() using the
    filter= parameter with a value of data or tar. See the tarfile extraction filters documentation
    https://docs.python.org/3/library/tarfile.html#tarfile-extraction-filter  for more information. Note that
    for Python 3.14 or later the default value of filter= changed from no filtering to `data, so if you
    are relying on this new default behavior then your usage is also affected. Note that none of these
    vulnerabilities significantly affect the installation of source distributions which are tar archives as
    source distributions already allow arbitrary code execution during the build process. However when
    evaluating source distributions it's important to avoid installing source distributions with suspicious
    links.
    CVE-2025-4138
    Allows the extraction filter to be ignored, allowing symlink targets to point outside the destination
    directory, and the modification of some file metadata. You are affected by this vulnerability if using the
    tarfile module to extract untrusted tar archives using TarFile.extractall() or TarFile.extract() using the
    filter= parameter with a value of data or tar. See the tarfile extraction filters documentation
    https://docs.python.org/3/library/tarfile.html#tarfile-extraction-filter  for more information. Note that
    for Python 3.14 or later the default value of filter= changed from no filtering to `data, so if you
    are relying on this new default behavior then your usage is also affected. Note that none of these
    vulnerabilities significantly affect the installation of source distributions which are tar archives as
    source distributions already allow arbitrary code execution during the build process. However when
    evaluating source distributions it's important to avoid installing source distributions with suspicious
    links.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://tsn.miraclelinux.com/en/node/22295");
  script_set_attribute(attribute:"solution", value:
"Update the affected packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:P");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-4517");
  script_set_attribute(attribute:"cvss4_score_source", value:"CVE-2024-12718");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"vendor_severity", value:"High");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/06/03");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/11/26");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/01/13");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:python3");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:python3-debug");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:python3-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:python3-idle");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:python3-libs");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:python3-test");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:python3-tkinter");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:miracle:linux:7");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Miracle Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/MiracleLinux/release", "Host/MiracleLinux/rpm-list", "Host/cpu");

  exit(0);
}


include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'MIRACLE LINUX' >!< os_product) audit(AUDIT_OS_NOT, 'MIRACLE LINUX');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'MIRACLE LINUX');
if (! preg(pattern:"^7([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'MiracleLinux 7.x', 'MIRACLE LINUX ' + os_version);

if (!get_kb_item('Host/MiracleLinux/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('aarch64' >!< cpu && 'ppc' >!< cpu && 's390' >!< cpu && 'x86_64' >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'MIRACLE LINUX', cpu);

var constraints = [
  {
    'release': '7',
    'pkgs': [
      {'reference':'python3-3.6.8-21.0.5.0.2.el7.AXS7', 'cpu':'i686', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'python3-3.6.8-21.0.5.0.2.el7.AXS7', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'python3-debug-3.6.8-21.0.5.0.2.el7.AXS7', 'cpu':'i686', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'python3-debug-3.6.8-21.0.5.0.2.el7.AXS7', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'python3-devel-3.6.8-21.0.5.0.2.el7.AXS7', 'cpu':'i686', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'python3-devel-3.6.8-21.0.5.0.2.el7.AXS7', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'python3-idle-3.6.8-21.0.5.0.2.el7.AXS7', 'cpu':'i686', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'python3-idle-3.6.8-21.0.5.0.2.el7.AXS7', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'python3-libs-3.6.8-21.0.5.0.2.el7.AXS7', 'cpu':'i686', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'python3-libs-3.6.8-21.0.5.0.2.el7.AXS7', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'python3-test-3.6.8-21.0.5.0.2.el7.AXS7', 'cpu':'i686', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'python3-test-3.6.8-21.0.5.0.2.el7.AXS7', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'python3-tkinter-3.6.8-21.0.5.0.2.el7.AXS7', 'cpu':'i686', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'python3-tkinter-3.6.8-21.0.5.0.2.el7.AXS7', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}
if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'python3 / python3-debug / python3-devel / python3-idle / etc');
}