Python Unsupported Version Detection

Tenable Plugin 148367 fires when it detects any Python installation whose upstream CPython release branch has passed its end-of-life date. As of September 2026, that means Python 2.7 (EOL Jan 2020), 3.6 (EOL Dec 2021), 3.7 (EOL Jun 2023), 3.8 (EOL Oct 2024), and 3.9 (EOL Oct 2025) — with 3.10 joining the club on October 31, 2026, barely five weeks from now. The plugin uses a hardcoded synthetic CVSS vector of CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H — a perfect 10.0 — applied identically to every unsupported-software detection regardless of whether the software is network-reachable, locally exploitable, or even genuinely unsupported (vendor-backported installs are routinely false-positived).

The vendor severity of CRITICAL does not match reality for the vast majority of deployments. Python is an interpreter, not a listening network service; the AV:N base metric is fictional. The plugin carries no CVE identifier because there is no specific vulnerability — it is a lifecycle posture finding. Individual CVEs that affect EOL Python branches (like CVE-2025-15366, CVE-2025-15367, or CVE-2026-1299) are flagged by their own dedicated plugins with accurate CVSS vectors. Plugin 148367 is a blanket hygiene signal that Tenable has chosen to score as though an unauthenticated remote attacker can fully compromise your host with no interaction — a claim that is categorically false for an interpreter binary sitting on disk. Making it worse, this plugin is the single highest-volume CRITICAL finding in most enterprise Tenable deployments, drowning out real critical vulnerabilities and directly contributing to alert fatigue.

1. Triage every hit — separate real EOL from vendor-backported false positives — Before patching anything, filter your Plugin 148367 findings. VMware appliances, Cisco gear, and RHEL/CentOS hosts with active OS support are almost certainly false positives — the OS vendor backports Python security patches. Remove these from your remediation queue immediately. This alone may cut your finding count by 30–60%. No mitigation SLA applies at MEDIUM severity — go straight to the 365-day remediation window.
2. Upgrade genuinely EOL Python to a supported branch — For confirmed true positives, upgrade to Python 3.12+ (longest remaining support runway). Prioritize hosts in CI/CD, web-serving, and infrastructure-automation roles. For Python 2.7 hosts, this likely requires application refactoring — start planning now. Target completion within the noisgate 365-day remediation window for MEDIUM severity.
3. Inventory Python installations with SBOM tooling — Deploy Syft, Trivy, or Grype to generate SBOMs for every host. This gives you ground truth on which Python version is *actually* installed (not just what Tenable thinks it found) and which specific CVEs affect it. Individual high-severity CVEs should be prioritized based on their own CVSS/EPSS scores, not the blanket Plugin 148367 finding.
4. Containerize Python workloads to bound blast radius — Where upgrading the system Python is impractical (legacy apps, vendor dependencies), isolate Python workloads in containers with minimal base images (e.g., python:3.12-slim). This limits the blast radius of any exploitation and decouples the application Python version from the system Python.
5. Accept risk and suppress findings for vendor-managed appliances — For VMware ESXi, Cisco, and similar appliances where you cannot control the embedded Python version, document a risk acceptance and suppress Plugin 148367 in your Tenable policy. The appliance vendor is responsible for security patching; this finding is not actionable by your team.

Run this on each target Linux/macOS host as any user. It checks all python and python3 binaries in $PATH plus common install locations, and compares their version against known upstream EOL dates. Example: bash check_python_eol.sh. No elevated privileges required.

#!/usr/bin/env bash
# check_python_eol.sh — Detect EOL Python installations
# noisgate verification for Tenable Plugin 148367
# Run on target host. No root required.
# Exit codes: 1=VULNERABLE (EOL found), 0=PATCHED (all supported), 2=UNKNOWN

set -euo pipefail

TODAY=$(date +%s)
FOUND_EOL=0
FOUND_ANY=0

# Upstream EOL dates (YYYY-MM-DD) from endoflife.date
declare -A EOL_DATES=(
  ["2.7"]="2020-01-01"
  ["2.6"]="2013-10-29"
  ["3.0"]="2009-06-27"
  ["3.1"]="2012-06-27"
  ["3.2"]="2016-02-20"
  ["3.3"]="2017-09-29"
  ["3.4"]="2019-03-18"
  ["3.5"]="2020-09-30"
  ["3.6"]="2021-12-23"
  ["3.7"]="2023-06-27"
  ["3.8"]="2024-10-07"
  ["3.9"]="2025-10-31"
  ["3.10"]="2026-10-31"
)

check_python() {
  local bin="$1"
  if [ ! -x "$bin" ]; then return; fi
  local ver
  ver=$( "$bin" --version 2>&1 | grep -oP '\d+\.\d+' | head -1 ) || return
  if [ -z "$ver" ]; then return; fi
  FOUND_ANY=1
  local eol_date="${EOL_DATES[$ver]:-}"
  if [ -z "$eol_date" ]; then
    echo "[INFO] $bin -> Python $ver (supported or unknown branch)"
    return
  fi
  local eol_ts
  eol_ts=$(date -d "$eol_date" +%s 2>/dev/null || date -jf "%Y-%m-%d" "$eol_date" +%s 2>/dev/null || echo 0)
  if [ "$TODAY" -ge "$eol_ts" ]; then
    echo "[EOL]  $bin -> Python $ver (upstream EOL: $eol_date)"
    FOUND_EOL=1
  else
    echo "[OK]   $bin -> Python $ver (upstream EOL: $eol_date — still supported)"
  fi
}

# Search PATH and common locations
for candidate in $(which -a python python2 python3 python3.6 python3.7 python3.8 python3.9 python3.10 2>/dev/null | sort -u); do
  check_python "$candidate"
done
for d in /usr/bin /usr/local/bin /opt/*/bin /usr/lib/vmware/*/bin; do
  for p in "$d"/python* 2>/dev/null; do
    [ -x "$p" ] && check_python "$p"
  done
done

if [ "$FOUND_ANY" -eq 0 ]; then
  echo "UNKNOWN — no Python installation detected"
  exit 2
elif [ "$FOUND_EOL" -eq 1 ]; then
  echo "VULNERABLE — one or more EOL Python installations found"
  exit 1
else
  echo "PATCHED — all detected Python installations are within upstream support"
  exit 0
fi

1. Tenable Plugin 148367 — Python Unsupported Version Detection
2. Python EOL Schedule — endoflife.date
3. Broadcom KB — VMware ESXi False Positive for Plugin 148367
4. Tenable Connect — Plugin 148367 Discussion
5. Python Security Vulnerabilities 2026 — stack.watch
6. HeroDevs — Python EOL Dates and Support Timeline
7. CyRisk — Mitigation Instructions for Plugin 148367
8. Python CVE List — CVEDetails