Python < 3.11.18 / 3.12.x < 3.12.16 / 3.13.x < 3.13.18 / 3.14.x < 3.14.10 / 3.15.x < 3.15.2 / 3.16.x < 3.16.0 Multiple Vulnerabilities

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(373609);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/29");

  script_cve_id("CVE-2026-114583", "CVE-2026-115557");

  script_name(english:"Python < 3.11.18 / 3.12.x < 3.12.16 / 3.13.x < 3.13.18 / 3.14.x < 3.14.10 / 3.15.x < 3.15.2 / 3.16.x < 3.16.0 Multiple Vulnerabilities");

  script_set_attribute(attribute:"synopsis", value:
"The remote host has an application installed that is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The version of Python installed on the remote Windows host is prior to 3.11.18, or is 3.12.x prior to 3.12.16, or
3.13.x prior to 3.13.18, or 3.14.x prior to 3.14.10, or 3.15.x prior to 3.15.2, or 3.16.x prior to 3.16.0. It is,
therefore, affected by multiple vulnerabilities:

  - tarfile.tar_filter could be bypassed using crafted link entries, including symlinks with empty or
    directory-like names, to redirect later archive members outside the intended extraction directory. This
    allowed a malicious tar archive to cause tarfile.extractall() with the 'tar' filter to write files outside
    the destination directory, subject to the permissions of the extracting process. (CVE-2026-114583)

  - Python has added a denylist for known compromised certificates to the 'ssl' module to ensure user safety
    even without certificate revocation configured. Known compromised certificates will automatically be
    rejected regardless of the SSLContext policy configuration. (CVE-2026-115557)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://mail.python.org/archives/list/[email protected]/thread/43JOWPRAV5DI3VZ4FUEUAZOHCATXXOCK/
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?25be97d3");
  # https://mail.python.org/archives/list/[email protected]/thread/FNAJMZV6XQYLVPABNINDMF3VF66AYLW4/
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?ce8092d0");
  script_set_attribute(attribute:"see_also", value:"https://github.com/python/cpython/issues/160040");
  script_set_attribute(attribute:"see_also", value:"https://github.com/python/cpython/issues/160097");
  script_set_attribute(attribute:"see_also", value:"https://github.com/python/cpython/pull/160042");
  script_set_attribute(attribute:"see_also", value:"https://github.com/python/cpython/pull/160098");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Python 3.11.18, 3.12.16, 3.13.18, 3.14.10, 3.15.2, 3.16.0 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-115557");

  script_cwe_id(299);

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/10/22");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/10/24");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/29");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:python:python");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Windows");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("python_win_installed.nbin");
  script_require_keys("installed_sw/Python Software Foundation Python", "SMB/Registry/Enumerated");

  exit(0);
}

include('vcf.inc');

get_kb_item_or_exit('SMB/Registry/Enumerated');

# CPython pre-releases use the compact PEP 440 forms 3.16.0a1 / 3.16.0b1, which vcf would
# otherwise parse as release segments and sort above the 3.16.0 final release
vcf::add_conversions({'a':vcf::conversions.alpha, 'b':vcf::conversions.beta});

var app_info = vcf::get_app_info(app:'Python Software Foundation Python', win_local:TRUE);

# app_info.version holds file version, like 3.14.6150.1013, which has no public translation to the version we want
# app_info.display_version holds correct version, so swap these
app_info.version = app_info.display_version;
app_info.parsed_version = vcf::parse_version(app_info.version);

var constraints = [
  {'fixed_version':'3.11.18'},
  {'min_version':'3.12', 'fixed_version':'3.12.16'},
  {'min_version':'3.13', 'fixed_version':'3.13.18'},
  {'min_version':'3.14', 'fixed_version':'3.14.10'},
  {'min_version':'3.15', 'fixed_version':'3.15.2'},
  {'min_version':'3.16.0a1', 'fixed_version':'3.16.0'}
];

vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_HOLE);