An update of the python3 package has been released.

The remote Red Hat Enterprise Linux CoreOS 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:1130 advisory.

  - jinja2: Jinja has a sandbox breakout through malicious filenames (CVE-2024-56201)

  - jinja2: Jinja has a sandbox breakout through indirect reference to format method (CVE-2024-56326)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Red Hat Enterprise Linux CoreOS 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:0834 advisory.

  - jinja2: Jinja has a sandbox breakout through malicious filenames (CVE-2024-56201)

  - jinja2: Jinja has a sandbox breakout through indirect reference to format method (CVE-2024-56326)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the python-jinja2 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    Jinja is an extensible templating engine. In versions on the 3.x branch prior to 3.1.5, a bug in the Jinja     compiler allows an attacker that controls both the content and filename of a template to execute arbitrary     Python code, regardless of if Jinja's sandbox is used. To exploit the vulnerability, an attacker needs to     control both the filename and the contents of a template. Whether that is the case depends on the type of     application using Jinja. This vulnerability impacts users of applications which execute untrusted     templates where the template author can also choose the template filename. (CVE-2024-56201)

    Jinja is an extensible templating engine. Prior to 3.1.5, An oversight in how the Jinja sandboxed     environment detects calls to str.format allows an attacker that controls the content of a template to     execute arbitrary Python code. To exploit the vulnerability, an attacker needs to control the content of a     template. Whether that is the case depends on the type of application using Jinja. This vulnerability     impacts users of applications which execute untrusted templates. Jinja's sandbox does catch calls to     str.format and ensures they don't escape the sandbox. However, it's possible to store a reference to a     malicious string's format method, then pass that to a filter that calls it. No such filters are built-in     to Jinja, but could be present through custom filters in an application. After the fix, such indirect     calls are also handled by the sandbox. (CVE-2024-56326)

Tenable has extracted the preceding description block directly from the EulerOS python-jinja2 security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the python-jinja2 package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

    Jinja is an extensible templating engine. Prior to 3.1.5, An oversight in how the Jinja sandboxed     environment detects calls to str.format allows an attacker that controls the content of a template to     execute arbitrary Python code. To exploit the vulnerability, an attacker needs to control the content of a     template. Whether that is the case depends on the type of application using Jinja. This vulnerability     impacts users of applications which execute untrusted templates. Jinja's sandbox does catch calls to     str.format and ensures they don't escape the sandbox. However, it's possible to store a reference to a     malicious string's format method, then pass that to a filter that calls it. No such filters are built-in     to Jinja, but could be present through custom filters in an application. After the fix, such indirect     calls are also handled by the sandbox.(CVE-2024-56326)

    Jinja is an extensible templating engine. In versions on the 3.x branch prior to 3.1.5, a bug in the Jinja     compiler allows an attacker that controls both the content and filename of a template to execute arbitrary     Python code, regardless of if Jinja's sandbox is used. To exploit the vulnerability, an attacker needs to     control both the filename and the contents of a template. Whether that is the case depends on the type of     application using Jinja. This vulnerability impacts users of applications which execute untrusted     templates where the template author can also choose the template filename. This vulnerability is fixed in     3.1.5.(CVE-2024-56201)

    Jinja is an extensible templating engine. Prior to 3.1.6, an oversight in how the Jinja sandboxed     environment interacts with the |attr filter allows an attacker that controls the content of a template to     execute arbitrary Python code. To exploit the vulnerability, an attacker needs to control the content of a     template. Whether that is the case depends on the type of application using Jinja. This vulnerability     impacts users of applications which execute untrusted templates. Jinja's sandbox does catch calls to     str.format and ensures they don't escape the sandbox. However, it's possible to use the |attr filter to     get a reference to a string's plain format method, bypassing the sandbox. After the fix, the |attr filter     no longer bypasses the environment's attribute lookup. This vulnerability is fixed in     3.1.6.(CVE-2025-27516)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization python-jinja2 security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.4 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_0527 advisory.

    This advisory aggregates security fixes for the fence-agents SRPM in CIQ LTS 9.4. It addresses 2 CVEs:
    CVE-2024-56201, CVE-2024-56326.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
333997	Photon OS 5.0: Python3 PHSA-2025-5.0-91-0515	Nessus	PhotonOS Local Security Checks	2026/8/10	2026/11/2	medium
311859	RHCOS 9 : OpenShift Container Platform 4.15.45 (RHSA-2025:1130)	Nessus	Red Hat Local Security Checks	2026/5/4	2026/5/4	medium
311928	RHCOS 9 : OpenShift Container Platform 4.12.72 (RHSA-2025:0834)	Nessus	Red Hat Local Security Checks	2026/5/4	2026/5/4	medium
233605	EulerOS 2.0 SP13 : python-jinja2 (EulerOS-SA-2025-1341)	Nessus	Huawei Local Security Checks	2025/4/1	2025/4/1	medium
347297	EulerOS Virtualization 2.11.1 : python-jinja2 (EulerOS-SA-2026-3460)	Nessus	Huawei Local Security Checks	2026/9/18	2026/9/18	medium
357147	Rocky Linux 9.4 [CIQ] Security Update: fence-agents-aliyun / fence-agents-all / fence-agents-amt-ws / etc Multiple Vulnerabilities (ciqsa-2026_0527)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/1	medium

検出

プラグインの検索

medium

medium

medium

medium

medium

medium