Python Improper Input Validation Vulnerability (Jan 2025) - Mac OS X

# SPDX-FileCopyrightText: 2025 Greenbone AG
# Some text descriptions might be excerpted from (a) referenced
# source(s), and are Copyright (C) by the respective right holder(s).
#
# SPDX-License-Identifier: GPL-2.0-only

CPE = "cpe:/a:python:python";

if(description)
{
  script_oid("1.3.6.1.4.1.25623.1.0.171145");
  script_version("2025-10-10T05:39:02+0000");
  script_tag(name:"last_modification", value:"2025-10-10 05:39:02 +0000 (Fri, 10 Oct 2025)");
  script_tag(name:"creation_date", value:"2025-02-04 08:54:34 +0000 (Tue, 04 Feb 2025)");
  script_tag(name:"cvss_base", value:"2.6");
  script_tag(name:"cvss_base_vector", value:"AV:N/AC:H/Au:N/C:N/I:P/A:N");

  script_cve_id("CVE-2025-0938");

  script_tag(name:"qod_type", value:"executable_version");

  script_tag(name:"solution_type", value:"VendorFix");

  script_name("Python Improper Input Validation Vulnerability (Jan 2025) - Mac OS X");

  script_category(ACT_GATHER_INFO);

  script_copyright("Copyright (C) 2025 Greenbone AG");
  script_family("General");
  script_dependencies("gb_python_consolidation.nasl");
  script_mandatory_keys("python/mac-os-x/detected");

  script_tag(name:"summary", value:"Python is prone to an improper input validation vulnerability
  in the urllib.parse.urlsplit and urlparse standard functions.");

  script_tag(name:"vuldetect", value:"Checks if a vulnerable version is present on the target host.");

  script_tag(name:"insight", value:"The Python standard library functions urllib.parse.urlsplit and
  urlparse accepted domain names that included square brackets which isn't valid according to RFC
  3986. Square brackets are only meant to be used as delimiters for specifying IPv6 and IPvFuture
  hosts in URLs. This could result in differential parsing across the Python URL parser and other
  specification-compliant URL parsers.");

  script_tag(name:"affected", value:"Python versions prior to 3.9.22, 3.10.x prior to 3.10.17,
  3.11.x prior to 3.11.12, 3.12.x prior to 3.12.9 and 3.13.x prior to 3.13.2.");

  script_tag(name:"solution", value:"Update to version 3.9.22, 3.10.17, 3.11.12, 3.12.9, 3.13.2 or
  later.");

  script_xref(name:"URL", value:"https://mail.python.org/archives/list/[email protected]/thread/K4EUG6EKV6JYFIC24BASYOZS4M5XOQIB/");
  script_xref(name:"URL", value:"https://github.com/python/cpython/issues/105704");
  script_xref(name:"URL", value:"https://github.com/python/cpython/pull/129418");
  script_xref(name:"URL", value:"https://docs.python.org/3.13/whatsnew/changelog.html#python-3-13-2-final");
  script_xref(name:"URL", value:"https://docs.python.org/3.12/whatsnew/changelog.html#python-3-12-9-final");
  script_xref(name:"URL", value:"https://docs.python.org/3.11/whatsnew/changelog.html#python-3-11-12-final");
  script_xref(name:"URL", value:"https://docs.python.org/3.10/whatsnew/changelog.html#python-3-10-17-final");
  script_xref(name:"URL", value:"https://docs.python.org/3.9/whatsnew/changelog.html#python-3-9-22-final");
  script_xref(name:"URL", value:"https://osv.dev/vulnerability/PSF-2025-1");
  # nb: The PSF seems to publish the affected / fixed versions in the "Product Status" part of
  # these since some time. So even it is a more generic link this should / will be always included.
  script_xref(name:"URL", value:"https://www.cve.org/CVERecord?id=CVE-2025-0938");

  exit(0);
}

include("host_details.inc");
include("version_func.inc");

if (isnull(port = get_app_port(cpe: CPE)))
  exit(0);

if (!infos = get_app_version_and_location(cpe: CPE, port: port, exit_no_version: TRUE,
                                          version_regex: "^[0-9]+\.[0-9]+\.[0-9]+"))
  exit(0);

version = infos["version"];
location = infos["location"];

if (version_is_less(version: version, test_version: "3.9.22")) {
  report = report_fixed_ver(installed_version: version, fixed_version: "3.9.22", install_path: location);
  security_message(port: port, data: report);
  exit(0);
}

if (version_in_range_exclusive(version: version, test_version_lo: "3.10", test_version_up: "3.10.17")) {
  report = report_fixed_ver(installed_version: version, fixed_version: "3.10.17", install_path: location);
  security_message(port: port, data: report);
  exit(0);
}

if (version_in_range_exclusive(version: version, test_version_lo: "3.11", test_version_up: "3.11.12")) {
  report = report_fixed_ver(installed_version: version, fixed_version: "3.11.12", install_path: location);
  security_message(port: port, data: report);
  exit(0);
}

if (version_in_range_exclusive(version: version, test_version_lo: "3.12", test_version_up: "3.12.9")) {
  report = report_fixed_ver(installed_version: version, fixed_version: "3.12.9", install_path: location);
  security_message(port: port, data: report);
  exit(0);
}

if (version_in_range_exclusive(version: version, test_version_lo: "3.13", test_version_up: "3.13.2")) {
  report = report_fixed_ver(installed_version: version, fixed_version: "3.13.2", install_path: location);
  security_message(port: port, data: report);
  exit(0);
}

exit(99);