Python DoS Vulnerability (Dec 2025) - Windows

# SPDX-FileCopyrightText: 2025 Greenbone AG
# Some text descriptions might be excerpted from (a) referenced
# source(s), and are Copyright (C) by the respective right holder(s).
#
# SPDX-License-Identifier: GPL-2.0-only

CPE = "cpe:/a:python:python";

if(description)
{
  script_oid("1.3.6.1.4.1.25623.1.0.125555");
  script_version("2026-01-16T05:47:38+0000");
  script_tag(name:"last_modification", value:"2026-01-16 05:47:38 +0000 (Fri, 16 Jan 2026)");
  script_tag(name:"creation_date", value:"2025-12-02 17:18:01 +0000 (Tue, 02 Dec 2025)");
  script_tag(name:"cvss_base", value:"4.9");
  script_tag(name:"cvss_base_vector", value:"AV:L/AC:L/Au:N/C:N/I:N/A:C");
  script_tag(name:"severity_vector", value:"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H");
  script_tag(name:"severity_origin", value:"NVD");
  script_tag(name:"severity_date", value:"2026-01-15 19:08:31 +0000 (Thu, 15 Jan 2026)");

  script_cve_id("CVE-2025-13837");

  script_tag(name:"qod_type", value:"remote_banner");

  script_tag(name:"solution_type", value:"VendorFix");

  script_name("Python DoS Vulnerability (Dec 2025) - Windows");

  script_category(ACT_GATHER_INFO);

  script_copyright("Copyright (C) 2025 Greenbone AG");
  script_family("Denial of Service");
  script_dependencies("gb_python_consolidation.nasl", "os_detection.nasl");
  script_mandatory_keys("python/detected", "Host/runs_windows");

  script_tag(name:"summary", value:"Python is prone to a denial of service (DoS) vulnerability.");

  script_tag(name:"vuldetect", value:"Checks if a vulnerable version is present on the target host.");

  script_tag(name:"insight", value:"When loading a plist file, the plistlib module reads data in
  size specified by the file itself, meaning a malicious file can cause out-of-memory (OOM) and
  DoS issues.");

  script_tag(name:"affected", value:"Python prior to version 3.13.10 and 3.14.x prior to 3.14.1.

  Note: Fixes have been backported to maintenance branches (3.10, 3.12) but specific
  patch versions are not yet available.");

  script_tag(name:"solution", value:"Update to version 3.13.10, 3.14.1 or later, or to the latest
  maintenance release of your Python version series (3.10.x, 3.12.x) once patches
  are available. Please see the references for more information.");

  script_xref(name:"URL", value:"https://github.com/python/cpython/issues/119342");
  script_xref(name:"URL", value:"https://github.com/python/cpython/pull/119343");
  script_xref(name:"URL", value:"https://github.com/python/cpython/commit/694922cf40aa3a28f898b5f5ee08b71b4922df70");
  script_xref(name:"URL", value:"https://github.com/python/cpython/commit/71fa8eb8233b37f16c88b6e3e583b461b205d1ba");
  script_xref(name:"URL", value:"https://github.com/python/cpython/commit/b64441e4852383645af5b435411a6f849dd1b4cb");
  script_xref(name:"URL", value:"https://www.cve.org/CVERecord?id=CVE-2025-13837");

  exit(0);
}

include("host_details.inc");
include("version_func.inc");

if (isnull(port = get_app_port(cpe: CPE)))
  exit(0);

if (!infos = get_app_version_and_location(cpe: CPE, port: port, exit_no_version: TRUE,
                                          version_regex: "^[0-9]+\.[0-9]+\.[0-9]+"))
  exit(0);

version = infos["version"];
location = infos["location"];

# TODO: Check the CVE entry again in 1/2 months to see if additional fixes for older branches have
# been published.
if (version_is_less(version: version, test_version: "3.13.10")) {
  report = report_fixed_ver(installed_version: version, fixed_version: "3.13.10", install_path: location);
  security_message(port: port, data: report);
  exit(0);
}

if (version_in_range_exclusive(version: version, test_version_lo: "3.14.0", test_version_up: "3.14.1")) {
  report = report_fixed_ver(installed_version: version, fixed_version: "3.14.1", install_path: location);
  security_message(port: port, data: report);
  exit(0);
}

exit(99);