The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:1878 advisory.

    Red Hat Update Infrastructure (RHUI) offers a highly scalable, highly redundant     framework that enables you to manage repositories and content. It also enables     cloud providers to deliver content and updates to Red Hat Enterprise Linux     (RHEL) instances.

    Security Fix(es):

    * python-django: Potential regular expression denial of service vulnerability in     EmailValidator/URLValidator (CVE-2023-36053)

    * python-aiohttp: HTTP request smuggling via llhttp HTTP request parser (CVE-2023-37276)

    * python-django: Potential denial of service vulnerability in ``django.utils.encoding.uri_to_iri()``     (CVE-2023-41164)

    * python-django: Denial-of-service possibility in django.utils.text.Truncator (CVE-2023-43665)

    * python-aiohttp: numerous issues in HTTP parser with header parsing (CVE-2023-47627)

    * aiohttp: HTTP request modification (CVE-2023-49081)

    * python-cryptography: NULL-dereference when loading PKCS7 certificates (CVE-2023-49083)

    * jinja2: HTML attribute injection when passing user input as keys to xmlattr filter (CVE-2024-22195)

    * aiohttp: follow_symlinks directory traversal vulnerability (CVE-2024-23334)

    * python-ecdsa: vulnerable to the Minerva attack (CVE-2024-23342)

    * python-aiohttp: http request smuggling (CVE-2024-23829)

    * Django: denial-of-service in ``intcomma`` template filter (CVE-2024-24680)

    * python-django: Potential regular expression denial-of-service in django.utils.text.Truncator.words()     (CVE-2024-27351)

    * aiohttp: CRLF injection if user controls the HTTP method using aiohttp client (CVE-2023-49082)

    This RHUI update fixes the following bugs:

    * The rhui-installer failed on RHEL 8.10 Beta due to the use of distutils. This has been addressed by     updating to a newer version of ansible-collection-community-crypto which does not use the distutils.

    This RHUI update introduces the following enhancements:

    * A native Ansible module is now used to update the packages on the RHUA server when the RHUI installer is     run for the first time or rerun at any time. This update can be prevented by using the --ignore-newer-     rhel-packages flag on the rhui-installer command line.

    * PulpCore has been updated to version 3.39.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:1536 advisory.

    Red Hat Satellite is a system management solution that allows organizations     to configure and maintain their systems without the necessity to provide     public Internet access to their servers or other client systems. It     performs provisioning and configuration management of predefined standard     operating environments.
    Security Fix(es):

    * automation-hub: Ansible Automation Hub: insecure galaxy-importer tarfile extraction (CVE-2023-5189)
    * python-aiohttp: aiohttp: follow_symlinks directory traversal vulnerability (CVE-2024-23334)
    * python-aiohttp: http request smuggling (CVE-2024-23829)
    * python-aiohttp: numerous issues in HTTP parser with header parsing (CVE-2023-47627)
    * python-aiohttp: aiohttp: HTTP request modification (CVE-2023-49081)
    * python-django: Denial-of-service possibility in django.utils.text.Truncator (CVE-2023-43665)
    * python-jinja2: jinja2: HTML attribute injection when passing user input as keys to xmlattr filter     (CVE-2024-22195)

    Bug Fix(es):
    2266107 - hammer host list does not print parameters even if they are present in the fields list like LCE     and CVs.
    2266110 - Incremental update of *multiple* CVs with same repo of different content generates wrong katello     content     2266139 - Failed incremental CV import shows error: duplicate key value violates unique constraint     rpm_updatecollectionname_name_update_record_id_6ef33bed_uniq     2266140 - wrong links to provisioning guide in CR help     2266142 - When using the customer data (json) with 13 diff conf files, we can see some weird behavior when     updating the hypervisors     2266144 - Promoting a composite content view to environment with registry name as <%=     lifecycle_environment.label %>/<%= repository.name %> on Red Hat Satellite 6 fails with 'undefined     method '#label' for NilClass::Jail (NilClass)'     2266145 - CertificateCleanupJob fails with foreign key constraint violation on table cp_certificate     2266146 - katello:reimport fails with TypeError: no implicit conversion of String into Integer when     there are product contents to move     2266147 - Postgresql logs contain PG::UniqueViolation: ERROR: duplicate key value violates unique     constraint katello_available_module_streams_name_stream_context     2266148 - Adding a CV to a CCV lists CV versions disorderly     2266149 - 'Remove orphans' task fails on DeleteOrphanAlternateContentSources step     2266413 - [RFE] Add content view window and Update version window should display content view version,     description and publishing date     2266113 - [RFE] To make customers aware about satellite versions going EOL by adding warning banner on the     Login page or on the Dashboard page.
    2266141 - wrong link to scap content documentation     Users of Red Hat Satellite are advised to upgrade to these updated     packages, which fix these bugs.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-000168 advisory.

    In Django 3.2 before 3.2.22, 4.1 before 4.1.12, and 4.2 before 4.2.6, the django.utils.text.Truncator     chars() and words() methods (when used with html=True) are subject to a potential DoS (denial of service)     attack via certain inputs with very long, potentially malformed HTML text. The chars() and words() methods     are used to implement the truncatechars_html and truncatewords_html template filters, which are thus also     vulnerable. NOTE: this issue exists because of an incomplete fix for CVE-2019-14232.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 22.04 LTS / 23.04 host has a package installed that is affected by a vulnerability as referenced in the USN-6414-1 advisory.

    Wenchao Li discovered that the Django Truncator function incorrectly handled very long HTML input. A     remote attacker could possibly use this issue to cause Django to consume resources, leading to a denial of     service.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4210 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4210-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                           Chris Lamb     June 09, 2025                                 https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : python-django     Version        : 2:2.2.28-1~deb11u7     CVE IDs        : CVE-2025-48432 CVE-2025-32873 CVE-2023-41164 CVE-2023-43665 CVE-2024-24680 CVE-2024-27351     Debian Bugs    : 1107282 1104872 1051226

    A number of vulnerabilities were discovered in Django, a popular     Python-based web-development framework:

     * CVE-2025-48432: Potential log injection via unescaped request path.

       Django's internal HTTP response logging used request.path directly,        allowing control characters (e.g. newlines or ANSI escape sequences) to        be written unescaped into logs. This could enable log injection or        forgery, letting attackers manipulate log appearance or structure,        especially in logs processed by external systems or viewed in terminals.
       (Closes: #1107282)

     * CVE-2025-32873: Denial-of-service possibility in strip_tags()

       django.utils.html.strip_tags() would be slow to evaluate certain inputs        containing large sequences of incomplete HTML tags. This function is used        to implement the striptags template filter, which was therefore also        vulnerable. strip_tags() now raises a SuspiciousOperation exception if it        encounters an unusually large number of unclosed opening tags.
       (Closes: #1104872)

     * CVE-2023-41164: Potential denial of service vulnerability in        django.utils.encoding.uri_to_iri(). This method was subject to potential        denial of service attack via certain inputs with a very large number of        Unicode characters. (Closes: #1051226)

     * CVE-2023-43665: Address a denial-of-service possibility in        django.utils.text.Truncator.

       Following the fix for CVE-2019-14232, the regular expressions used in the        implementation of django.utils.text.Truncator??s chars() and words()        methods (with html=True) were revised and improved. However, these        regular expressions still exhibited linear backtracking complexity, so        when given a very long, potentially malformed HTML input, the evaluation        would still be slow, leading to a potential denial of service        vulnerability. The chars() and words() methods are used to        implement the truncatechars_html and truncatewords_html template        filters, which were thus also vulnerable. The input processed by        Truncator, when operating in HTML mode, has been limited to the        first five million characters in order to avoid potential        performance and memory issues.

     * CVE-2024-24680: Potential denial-of-service in intcomma template        filter. The intcomma template filter was subject to a potential        denial-of-service attack when used with very long strings.

     * CVE-2024-27351: Fix a potential regular expression denial-of-service        (ReDoS) attack in django.utils.text.Truncator.words. This method (with        html=True) and the truncatewords_html template filter were subject to a        potential regular expression denial-of-service attack via a suitably        crafted string. This is, in part, a follow up to CVE-2019-14232 and        CVE-2023-43665.

    For Debian 11 bullseye, these problems have been fixed in version     2:2.2.28-1~deb11u7.

    We recommend that you upgrade your python-django packages.

    For the detailed security status of python-django please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/python-django

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-84fbbbb914 advisory.

    Security fixes for

    - CVE-2024-27351 Potential regular expression DOS in `django.utils.text.Truncator.words()`
    - CVE-2024-24680 denial-of-service in ``intcomma`` template filter
    - CVE-2023-43665 Denial-of-service possibility in django.utils.text.Truncator
    - CVE-2023-41164 Potential DOS vulnerability in `django.utils.encoding.uri_to_iri()`
    - CVE-2023-36053 Potential regular expression denial of service vulnerability in     EmailValidator/URLValidator





Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2023:0390-1 advisory.

  - In Django 3.2 before 3.2.22, 4.1 before 4.1.12, and 4.2 before 4.2.6, the django.utils.text.Truncator     chars() and words() methods (when used with html=True) are subject to a potential DoS (denial of service)     attack via certain inputs with very long, potentially malformed HTML text. The chars() and words() methods     are used to implement the truncatechars_html and truncatewords_html template filters, which are thus also     vulnerable. NOTE: this issue exists because of an incomplete fix for CVE-2019-14232. (CVE-2023-43665)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:6158 advisory.

    Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing     IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to     individual teams, while automation developers retain the freedom to write tasks that leverage existing     knowledge without the overhead. Ansible Automation Platform makes it possible for users across an     organization to share, vet, and manage automation content by means of a simple, powerful, and agentless     language.

    Security Fix(es):

    *  automation-controller: Django: Denial-of-service possibility in django.utils.text.Truncator     (CVE-2023-43665)

    * python3-urllib3/python39-urllib3: Cookie request header isn't stripped during cross-origin redirects     (CVE-2023-43804)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Updates and fixes for automation controller:
    * automation-controller has been updated to 4.4.7
    * Cleaned up SOS report passwords (AAP-17544)
    * Customers using the infra.controller_configuration collection (which uses ansible.controller     collection) to update their Ansible Automation Platform environment no longer receive an HTTP 499 response     (AAP-17422)

    Additional changes:
    * python3-urllib3/python39-urllib3 has been updated to 1.26.18

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6136 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6136-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     February 15, 2026                     https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : python-django     CVE ID         : CVE-2023-41164 CVE-2023-43665 CVE-2024-24680 CVE-2024-27351                      CVE-2024-39329 CVE-2024-39330 CVE-2024-39614 CVE-2024-41989                      CVE-2024-41991 CVE-2024-42005 CVE-2024-45231 CVE-2024-53907                      CVE-2024-56374 CVE-2025-13372 CVE-2025-26699 CVE-2025-32873                      CVE-2025-48432 CVE-2025-57833 CVE-2025-59681 CVE-2025-59682                      CVE-2025-64459 CVE-2025-64460

    Multiple security issues were found in Django, a Python web development     framework, which could result in denial of service, information     disclosure, directory traversal or SQL injection.

    For the oldstable distribution (bookworm), these problems have been fixed     in version 3:3.2.25-0+deb12u1. python-django-storages also needed to be     updated to ensure ongoing compatibility (1.13.2-1+deb12u1).

    We recommend that you upgrade your python-django packages.

    For the detailed security status of python-django please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/python-django

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6414-2 advisory.

    USN-6414-1 and USN-6378-1 fixed CVE-2023-43665 and CVE-2023-41164 in Django, respectively. This update     provides the corresponding update for Ubuntu 18.04 LTS.



Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2023-cc023fabb7 advisory.

    Security fix for CVE-2023-43665, CVE-2023-41164, and CVE-2023-36053

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2023:0389-1 advisory.

  - In Django 3.2 before 3.2.22, 4.1 before 4.1.12, and 4.2 before 4.2.6, the django.utils.text.Truncator     chars() and words() methods (when used with html=True) are subject to a potential DoS (denial of service)     attack via certain inputs with very long, potentially malformed HTML text. The chars() and words() methods     are used to implement the truncatechars_html and truncatewords_html template filters, which are thus also     vulnerable. NOTE: this issue exists because of an incomplete fix for CVE-2019-14232. (CVE-2023-43665)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In Django 3.2 before 3.2.22, 4.1 before 4.1.12, and 4.2 before 4.2.6, the django.utils.text.Truncator     chars() and words() methods (when used with html=True) are subject to a potential DoS (denial of service)     attack via certain inputs with very long, potentially malformed HTML text. The chars() and words() methods     are used to implement the truncatechars_html and truncatewords_html template filters, which are thus also     vulnerable. NOTE: this issue exists because of an incomplete fix for CVE-2019-14232. (CVE-2023-43665)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-a67af7d8f4 advisory.

    Security fix for CVE-2023-41164 and CVE-2023-43665




Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 4f254817-6318-11ee-b2ff-080027de9982 advisory.

  - Django reports: CVE-2023-43665: Denial-of-service possibility in django.utils.text.Truncator.
    (CVE-2023-43665)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
193467	RHEL 8 : RHUI 4.8 Release - Security Updates, Bug Fixes, and Enhancements (Moderate) (RHSA-2024:1878)	Nessus	Red Hat Local Security Checks	2024/4/18	2024/11/7	critical
194355	RHEL 8 : Satellite 6.14.3 Async Security Update (Moderate) (RHSA-2024:1536)	Nessus	Red Hat Local Security Checks	2024/4/28	2025/3/6	high
281986	Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: python-django (UTSA-2026-000168)	Nessus	Unity Linux Local Security Checks	2026/1/7	2026/1/7	high
182529	Ubuntu 20.04 LTS / 22.04 LTS / 23.04 : Django vulnerability (USN-6414-1)	Nessus	Ubuntu Local Security Checks	2023/10/4	2024/8/27	high
238025	Debian dla-4210 : python-django-doc - security update	Nessus	Debian Local Security Checks	2025/6/9	2025/6/9	high
193650	Fedora 38 : python-django3 (2024-84fbbbb914)	Nessus	Fedora Local Security Checks	2024/4/20	2024/11/14	high
186583	openSUSE 15 Security Update : python-Django1 (openSUSE-SU-2023:0390-1)	Nessus	SuSE Local Security Checks	2023/12/5	2023/12/5	high
194399	RHEL 8 / 9 : Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update (Moderate) (RHSA-2023:6158)	Nessus	Red Hat Local Security Checks	2024/4/28	2024/11/7	critical
299143	Debian dsa-6136 : python-django-doc - security update	Nessus	Debian Local Security Checks	2026/2/15	2026/2/15	critical
182577	Ubuntu 18.04 ESM : Django vulnerabilities (USN-6414-2)	Nessus	Ubuntu Local Security Checks	2023/10/5	2024/10/29	high
183095	Fedora 38 : python-asgiref / python-django (2023-cc023fabb7)	Nessus	Fedora Local Security Checks	2023/10/15	2024/11/14	high
186582	openSUSE 15 Security Update : python-Django1 (openSUSE-SU-2023:0389-1)	Nessus	SuSE Local Security Checks	2023/12/5	2023/12/5	high
226971	Linux Distros Unpatched Vulnerability : CVE-2023-43665	Nessus	Misc.	2025/3/5	2026/8/5	high
185323	Fedora 39 : python-django (2023-a67af7d8f4)	Nessus	Fedora Local Security Checks	2023/11/7	2024/11/14	high
182574	FreeBSD : Django -- multiple vulnerabilities (4f254817-6318-11ee-b2ff-080027de9982)	Nessus	FreeBSD Local Security Checks	2023/10/5	2023/11/14	high

检测

插件搜索

critical

high

high

high

high

high

high

critical

critical

high

high

high

high

high

high