The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-a67af7d8f4 advisory.

    Security fix for CVE-2023-41164 and CVE-2023-43665




Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:5701 advisory.

    Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing     IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to     individual teams, while automation developers retain the freedom to write tasks that leverage existing     knowledge without the overhead. Ansible Automation Platform makes it possible for users across an     organization to share, vet, and manage automation content by means of a simple, powerful, and agentless     language.

    Security Fix(es):
    * ansible-core: malicious role archive can cause ansible-galaxy to overwrite arbitrary files     (CVE-2023-5115)
    * automation-controller: Django: Potential denial of service vulnerability in     django.utils.encoding.uri_to_iri() (CVE-2023-41164)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional changes:
    * ansible-core has been updated to 2.14.11
    * automation-controller has been updated to 4.3.16

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In Django 3.2 before 3.2.21, 4.1 before 4.1.11, and 4.2 before 4.2.5, django.utils.encoding.uri_to_iri()     is subject to a potential DoS (denial of service) attack via certain inputs with a very large number of     Unicode characters. (CVE-2023-41164)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Ubuntu 20.04 LTS / 22.04 LTS / 23.04 host has a package installed that is affected by a vulnerability as referenced in the USN-6378-1 advisory.

    It was discovered that Django incorrectly handled certain URIs with a very large number of Unicode     characters. A remote attacker could possibly use this issue to cause Django to consume resources or crash,     leading to a denial of service.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4210 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4210-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                           Chris Lamb     June 09, 2025                                 https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : python-django     Version        : 2:2.2.28-1~deb11u7     CVE IDs        : CVE-2025-48432 CVE-2025-32873 CVE-2023-41164 CVE-2023-43665 CVE-2024-24680 CVE-2024-27351     Debian Bugs    : 1107282 1104872 1051226

    A number of vulnerabilities were discovered in Django, a popular     Python-based web-development framework:

     * CVE-2025-48432: Potential log injection via unescaped request path.

       Django's internal HTTP response logging used request.path directly,        allowing control characters (e.g. newlines or ANSI escape sequences) to        be written unescaped into logs. This could enable log injection or        forgery, letting attackers manipulate log appearance or structure,        especially in logs processed by external systems or viewed in terminals.
       (Closes: #1107282)

     * CVE-2025-32873: Denial-of-service possibility in strip_tags()

       django.utils.html.strip_tags() would be slow to evaluate certain inputs        containing large sequences of incomplete HTML tags. This function is used        to implement the striptags template filter, which was therefore also        vulnerable. strip_tags() now raises a SuspiciousOperation exception if it        encounters an unusually large number of unclosed opening tags.
       (Closes: #1104872)

     * CVE-2023-41164: Potential denial of service vulnerability in        django.utils.encoding.uri_to_iri(). This method was subject to potential        denial of service attack via certain inputs with a very large number of        Unicode characters. (Closes: #1051226)

     * CVE-2023-43665: Address a denial-of-service possibility in        django.utils.text.Truncator.

       Following the fix for CVE-2019-14232, the regular expressions used in the        implementation of django.utils.text.Truncator??s chars() and words()        methods (with html=True) were revised and improved. However, these        regular expressions still exhibited linear backtracking complexity, so        when given a very long, potentially malformed HTML input, the evaluation        would still be slow, leading to a potential denial of service        vulnerability. The chars() and words() methods are used to        implement the truncatechars_html and truncatewords_html template        filters, which were thus also vulnerable. The input processed by        Truncator, when operating in HTML mode, has been limited to the        first five million characters in order to avoid potential        performance and memory issues.

     * CVE-2024-24680: Potential denial-of-service in intcomma template        filter. The intcomma template filter was subject to a potential        denial-of-service attack when used with very long strings.

     * CVE-2024-27351: Fix a potential regular expression denial-of-service        (ReDoS) attack in django.utils.text.Truncator.words. This method (with        html=True) and the truncatewords_html template filter were subject to a        potential regular expression denial-of-service attack via a suitably        crafted string. This is, in part, a follow up to CVE-2019-14232 and        CVE-2023-43665.

    For Debian 11 bullseye, these problems have been fixed in version     2:2.2.28-1~deb11u7.

    We recommend that you upgrade your python-django packages.

    For the detailed security status of python-django please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/python-django

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6414-2 advisory.

    USN-6414-1 and USN-6378-1 fixed CVE-2023-43665 and CVE-2023-41164 in Django, respectively. This update     provides the corresponding update for Ubuntu 18.04 LTS.



Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2023-cc023fabb7 advisory.

    Security fix for CVE-2023-43665, CVE-2023-41164, and CVE-2023-36053

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202509-03 (Django: Multiple Vulnerabilities)

    Multiple vulnerabilities have been discovered in Django. Please review the CVE identifiers referenced     below for details.

Tenable has extracted the preceding description block directly from the Gentoo Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
185323	Fedora 39 : python-django (2023-a67af7d8f4)	Nessus	Fedora Local Security Checks	2023/11/7	2024/11/14	high
194401	RHEL 8 / 9 : Red Hat Ansible Automation Platform 2.3 Product Security and Bug Fix Update (Moderate) (RHSA-2023:5701)	Nessus	Red Hat Local Security Checks	2024/4/28	2024/11/7	medium
227107	Linux Distros Unpatched Vulnerability : CVE-2023-41164	Nessus	Misc.	2025/3/5	2026/2/15	high
181542	Ubuntu 20.04 LTS / 22.04 LTS / 23.04 : Django vulnerability (USN-6378-1)	Nessus	Ubuntu Local Security Checks	2023/9/18	2024/8/27	high
238025	Debian dla-4210 : python-django-doc - security update	Nessus	Debian Local Security Checks	2025/6/9	2025/6/9	high
182577	Ubuntu 18.04 ESM : Django vulnerabilities (USN-6414-2)	Nessus	Ubuntu Local Security Checks	2023/10/5	2024/10/29	high
183095	Fedora 38 : python-asgiref / python-django (2023-cc023fabb7)	Nessus	Fedora Local Security Checks	2023/10/15	2024/11/14	high
265369	GLSA-202509-03 : Django: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	2025/9/18	2025/9/18	critical

检测

插件搜索

high

medium

high

high

high

high

high

critical