Python < 3.10.22 / 3.11.x < 3.11.17 / 3.12.x < 3.12.15 / 3.13.x < 3.13.16 / 3.14.x < 3.14.0b1 Link Following

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(373610);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/29");

  script_cve_id("CVE-2026-82049");

  script_name(english:"Python < 3.10.22 / 3.11.x < 3.11.17 / 3.12.x < 3.12.15 / 3.13.x < 3.13.16 / 3.14.x < 3.14.0b1 Link Following");

  script_set_attribute(attribute:"synopsis", value:
"The remote host has an application installed that is affected by a link following vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of Python installed on the remote Windows host is prior to 3.10.22, or is 3.11.x prior to 3.11.17, or
3.12.x prior to 3.12.15, or 3.13.x prior to 3.13.16, or 3.14.x prior to 3.14.0b1. It is, therefore, affected by a link
following vulnerability. In CPython 3.13 and earlier, the tarfile module's data and tar extraction filters are
vulnerable to crafted archives containing a hard link to a symbolic link. Such archives may cause extraction to modify
the permissions or modification time of a file outside the destination directory, or expose the contents of that file
within the extracted tree.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://mail.python.org/archives/list/[email protected]/thread/EFJWGAZJA56AKSBR2WHMHQZO7RRLZPRH/
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?74c00ac7");
  script_set_attribute(attribute:"see_also", value:"https://github.com/python/cpython/issues/157190");
  script_set_attribute(attribute:"see_also", value:"https://github.com/python/cpython/pull/157191");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Python 3.10.22, 3.11.17, 3.12.15, 3.13.16, 3.14.0b1 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:N");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-82049");

  script_cwe_id(59);

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/09/14");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/09/14");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/29");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:python:python");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Windows");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("python_win_installed.nbin");
  script_require_keys("installed_sw/Python Software Foundation Python", "SMB/Registry/Enumerated");

  exit(0);
}

include('vcf.inc');

get_kb_item_or_exit('SMB/Registry/Enumerated');

# CPython pre-releases use the compact PEP 440 forms 3.14.0a1 / 3.14.0b1, which vcf would
# otherwise parse as release segments and sort above the 3.14.0 final release
vcf::add_conversions({'a':vcf::conversions.alpha, 'b':vcf::conversions.beta});

var app_info = vcf::get_app_info(app:'Python Software Foundation Python', win_local:TRUE);

# app_info.version holds file version, like 3.14.6150.1013, which has no public translation to the version we want
# app_info.display_version holds correct version, so swap these
app_info.version = app_info.display_version;
app_info.parsed_version = vcf::parse_version(app_info.version);

var constraints = [
  {'fixed_version':'3.10.22'},
  {'min_version':'3.11', 'fixed_version':'3.11.17'},
  {'min_version':'3.12', 'fixed_version':'3.12.15'},
  {'min_version':'3.13', 'fixed_version':'3.13.16'},
  {'min_version':'3.14.0a1', 'fixed_version':'3.14.0b1'}
];

vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_HOLE);