The remote Debian 11 / 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5465 advisory.

    Seokchan Yoon discovered that missing sanitising in the email and URL validators of Django, a Python web     development framework, could result in denial of service. For the oldstable distribution (bullseye), this     problem has been fixed in version 2:2.2.28-1~deb11u2. This update also addresses CVE-2023-23969,     CVE-2023-31047 and CVE-2023-24580. For the stable distribution (bookworm), this problem has been fixed in     version 3:3.2.19-1+deb12u1. We recommend that you upgrade your python-django packages. For the detailed     security status of python-django please refer to its security tracker page at: https://security-     tracker.debian.org/tracker/python-django

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 15 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2023:0057-1 advisory.

  - In Django 3.2 before 3.2.16, 4.0 before 4.0.8, and 4.1 before 4.1.2, internationalized URLs were subject     to a potential denial of service attack via the locale parameter, which is treated as a regular     expression. (CVE-2022-41323)

  - In Django 3.2 before 3.2.17, 4.0 before 4.0.9, and 4.1 before 4.1.6, the parsed values of Accept-Language     headers are cached in order to avoid repetitive parsing. This leads to a potential denial-of-service     vector via excessive memory usage if the raw value of Accept-Language headers is very large.
    (CVE-2023-23969)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-a53ab7c969 advisory.

    Security fix for:

     - CVE-2023-24580
     - CVE-2023-23969
     - CVE-2022-41323
     - CVE-2022-36359
     - CVE-2022-34265
     - CVE-2022-28346
     - CVE-2022-28347

    https://docs.djangoproject.com/en/4.2/releases/4.0.3/     https://docs.djangoproject.com/en/4.2/releases/4.0.4/     https://docs.djangoproject.com/en/4.2/releases/4.0.5/     https://docs.djangoproject.com/en/4.2/releases/4.0.6/     https://docs.djangoproject.com/en/4.2/releases/4.0.7/     https://docs.djangoproject.com/en/4.2/releases/4.0.8/     https://docs.djangoproject.com/en/4.2/releases/4.0.9/     https://docs.djangoproject.com/en/4.2/releases/4.0.10/

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:2097 advisory.

    Red Hat Satellite is a systems management tool for Linux-based     infrastructure. It allows for provisioning, remote management, and     monitoring of multiple Linux deployments with a single centralized tool.

    Security Fix(es):
    * CVE-2022-1471 CVE-2022-25857 CVE-2022-38749 CVE-2022-38750 CVE-2022-38751 CVE-2022-38752 candlepin and     puppetserver: various flaws
    * CVE-2022-22577 tfm-rubygem-actionpack: rubygem-actionpack: Possible cross-site scripting vulnerability     in Action Pack
    * CVE-2022-23514 rubygem-loofah: inefficient regular expression leading to denial of service
    * CVE-2022-23515 rubygem-loofah: rubygem-loofah: Improper neutralization of data URIs leading to Cross     Site Scripting
    * CVE-2022-23516 rubygem-loofah: Uncontrolled Recursion leading to denial of service
    * CVE-2022-23517 tfm-rubygem-rails-html-sanitizer: rubygem-rails-html-sanitizer: Inefficient Regular     Expression leading to denial of service
    * CVE-2022-23518 tfm-rubygem-rails-html-sanitizer: rubygem-rails-html-sanitizer: Improper neutralization     of data URIs leading to Cross site scripting
    * CVE-2022-23519 tfm-rubygem-rails-html-sanitizer: rubygem-rails-html-sanitizer: Cross site scripting     vulnerability with certain configurations
    * CVE-2022-23520 tfm-rubygem-rails-html-sanitizer: rubygem-rails-html-sanitizer: Cross site scripting     vulnerability with certain configurations
    * CVE-2022-27777 tfm-rubygem-actionview: Possible cross-site scripting vulnerability in Action View tag     helpers
    * CVE-2022-31163 rubygem-tzinfo: rubygem-tzinfo: arbitrary code execution
    * CVE-2022-32224 tfm-rubygem-activerecord: activerecord: Possible RCE escalation bug with Serialized     Columns in Active Record
    * CVE-2022-33980 candlepin: apache-commons-configuration2: Apache Commons Configuration insecure     interpolation defaults
    * CVE-2022-41323 satellite-capsule:el8/python-django: Potential denial-of-service vulnerability in     internationalized URLs
    * CVE-2022-41946 candlepin: postgresql-jdbc: Information leak of prepared statement data due to insecure     temporary file permissions
    * CVE-2022-42003 CVE-2022-42004 candlepin: various flaws
    * CVE-2022-42889 candlepin: apache-commons-text: variable interpolation RCE
    * CVE-2022-23514 rubygem-loofah: inefficient regular expression leading to denial of service
    * CVE-2023-23969 python-django: Potential denial-of-service via Accept-Language headers
    * CVE-2023-24580 python-django: Potential denial-of-service vulnerability in file uploads

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE     page(s) listed in the References section.

    Additional Changes:

    The items above are not a complete list of changes. This update also fixes     several bugs and adds various enhancements. Documentation for these changes     is available from the Release Notes document.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
179346	Debian DSA-5465-1 : python-django - security update	Nessus	Debian Local Security Checks	2023/8/4	2025/1/24	critical
171764	openSUSE 15 Security Update : python-Django (openSUSE-SU-2023:0057-1)	Nessus	SuSE Local Security Checks	2023/2/22	2023/2/22	high
174911	Fedora 38 : python-django (2023-a53ab7c969)	Nessus	Fedora Local Security Checks	2023/4/28	2024/11/14	critical
194316	RHEL 8 : Satellite 6.13 Release (Important) (RHSA-2023:2097)	Nessus	Red Hat Local Security Checks	2024/4/28	2024/11/7	critical

检测

插件搜索

critical

high

critical

critical