Python DoS Vulnerability (Oct 2025) - Windows

# SPDX-FileCopyrightText: 2025 Greenbone AG
# Some text descriptions might be excerpted from (a) referenced
# source(s), and are Copyright (C) by the respective right holder(s).
#
# SPDX-License-Identifier: GPL-2.0-only

CPE = "cpe:/a:python:python";

if(description)
{
  script_oid("1.3.6.1.4.1.25623.1.0.125435");
  script_version("2026-02-05T05:56:23+0000");
  script_tag(name:"last_modification", value:"2026-02-05 05:56:23 +0000 (Thu, 05 Feb 2026)");
  script_tag(name:"creation_date", value:"2025-11-03 12:34:51 +0000 (Mon, 03 Nov 2025)");
  script_tag(name:"cvss_base", value:"4.6");
  script_tag(name:"cvss_base_vector", value:"AV:L/AC:L/Au:S/C:N/I:N/A:C");
  script_tag(name:"severity_vector", value:"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H");
  script_tag(name:"severity_origin", value:"NVD");
  script_tag(name:"severity_date", value:"2026-02-04 18:46:13 +0000 (Wed, 04 Feb 2026)");

  script_cve_id("CVE-2025-6075");

  script_tag(name:"qod_type", value:"remote_banner");

  script_tag(name:"solution_type", value:"VendorFix");

  script_name("Python DoS Vulnerability (Oct 2025) - Windows");

  script_category(ACT_GATHER_INFO);

  script_copyright("Copyright (C) 2025 Greenbone AG");
  script_family("Denial of Service");
  script_dependencies("gb_python_consolidation.nasl", "os_detection.nasl");
  script_mandatory_keys("python/detected", "Host/runs_windows");

  script_tag(name:"summary", value:"Python is prone to a denial of service (DoS) vulnerability.");

  script_tag(name:"vuldetect", value:"Checks if a vulnerable version is present on the target host.");

  script_tag(name:"insight", value:"If the value passed to os.path.expandvars() is user-controlled
  a performance degradation is possible when expanding environment variables. This vulnerability
  exhibits quadratic complexity behavior that could be exploited for denial of service attacks.");

  script_tag(name:"affected", value:"Python versions prior to 3.9.25 and 3.10.x prior to 3.15.0.

  Note: Fixes have been backported to maintenance branches (3.10, 3.12, 3.13, 3.14) but specific
  patch versions are not yet available.");

  script_tag(name:"solution", value:"Update to Python 3.9.25, 3.15.0 or later, or to the latest
  maintenance release of your Python version series (3.10.x, 3.12.x, 3.13.x, 3.14.x) once patches
  are available. Please see the references for more information.");

  script_xref(name:"URL", value:"https://mail.python.org/archives/list/[email protected]/thread/IUP5QJ6D4KK6ULHOMPC7DPNKRYQTQNLA/");
  script_xref(name:"URL", value:"https://github.com/python/cpython/issues/136065");
  script_xref(name:"URL", value:"https://github.com/python/cpython/commit/2e6150adccaaf5bd95d4c19dfd04a36e0b325d8c");
  script_xref(name:"URL", value:"https://github.com/python/cpython/commit/631ba3407e3348ccd56ce5160c4fb2c5dc5f4d84");
  script_xref(name:"URL", value:"https://github.com/python/cpython/commit/892747b4cf0f95ba8beb51c0d0658bfaa381ebca");
  script_xref(name:"URL", value:"https://github.com/python/cpython/commit/9ab89c026aa9611c4b0b67c288b8303a480fe742");
  script_xref(name:"URL", value:"https://github.com/python/cpython/commit/c8a5f3435c342964e0a432cc9fb448b7dbecd1ba");
  script_xref(name:"URL", value:"https://github.com/python/cpython/commit/f029e8db626ddc6e3a3beea4eff511a71aaceb5c");
  script_xref(name:"URL", value:"https://docs.python.org/release/3.9.25/whatsnew/changelog.html");

  exit(0);
}

include("host_details.inc");
include("version_func.inc");

if (isnull(port = get_app_port(cpe: CPE)))
  exit(0);

if (!infos = get_app_version_and_location(cpe: CPE, port: port, exit_no_version: TRUE,
                                          version_regex: "^[0-9]+\.[0-9]+\.[0-9]+"))
  exit(0);

version = infos["version"];
location = infos["location"];

if (version_is_less(version: version, test_version: "3.9.25")) {
  report = report_fixed_ver(installed_version: version, fixed_version: "3.9.25", install_path: location);
  security_message(port: port, data: report);
  exit(0);
}

if (version_in_range_exclusive(version: version, test_version_lo: "3.10.0", test_version_up: "3.15.0")) {
  report = report_fixed_ver(installed_version: version, fixed_version: "3.15.0", install_path: location);
  security_message(port: port, data: report);
  exit(0);
}

exit(99);