The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In Django 3.2 before 3.2.22, 4.1 before 4.1.12, and 4.2 before 4.2.6, the django.utils.text.Truncator     chars() and words() methods (when used with html=True) are subject to a potential DoS (denial of service)     attack via certain inputs with very long, potentially malformed HTML text. The chars() and words() methods     are used to implement the truncatechars_html and truncatewords_html template filters, which are thus also     vulnerable. NOTE: this issue exists because of an incomplete fix for CVE-2019-14232. (CVE-2023-43665)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 4f254817-6318-11ee-b2ff-080027de9982 advisory.

  - Django reports: CVE-2023-43665: Denial-of-service possibility in django.utils.text.Truncator.
    (CVE-2023-43665)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-a67af7d8f4 advisory.

    Security fix for CVE-2023-41164 and CVE-2023-43665




Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2023:0390-1 advisory.

  - In Django 3.2 before 3.2.22, 4.1 before 4.1.12, and 4.2 before 4.2.6, the django.utils.text.Truncator     chars() and words() methods (when used with html=True) are subject to a potential DoS (denial of service)     attack via certain inputs with very long, potentially malformed HTML text. The chars() and words() methods     are used to implement the truncatechars_html and truncatewords_html template filters, which are thus also     vulnerable. NOTE: this issue exists because of an incomplete fix for CVE-2019-14232. (CVE-2023-43665)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-84fbbbb914 advisory.

    Security fixes for

    - CVE-2024-27351 Potential regular expression DOS in `django.utils.text.Truncator.words()`
    - CVE-2024-24680 denial-of-service in ``intcomma`` template filter
    - CVE-2023-43665 Denial-of-service possibility in django.utils.text.Truncator
    - CVE-2023-41164 Potential DOS vulnerability in `django.utils.encoding.uri_to_iri()`
    - CVE-2023-36053 Potential regular expression denial of service vulnerability in     EmailValidator/URLValidator





Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:6158 advisory.

    Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing     IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to     individual teams, while automation developers retain the freedom to write tasks that leverage existing     knowledge without the overhead. Ansible Automation Platform makes it possible for users across an     organization to share, vet, and manage automation content by means of a simple, powerful, and agentless     language.

    Security Fix(es):

    *  automation-controller: Django: Denial-of-service possibility in django.utils.text.Truncator     (CVE-2023-43665)

    * python3-urllib3/python39-urllib3: Cookie request header isn't stripped during cross-origin redirects     (CVE-2023-43804)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Updates and fixes for automation controller:
    * automation-controller has been updated to 4.4.7
    * Cleaned up SOS report passwords (AAP-17544)
    * Customers using the infra.controller_configuration collection (which uses ansible.controller     collection) to update their Ansible Automation Platform environment no longer receive an HTTP 499 response     (AAP-17422)

    Additional changes:
    * python3-urllib3/python39-urllib3 has been updated to 1.26.18

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6136 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6136-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     February 15, 2026                     https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : python-django     CVE ID         : CVE-2023-41164 CVE-2023-43665 CVE-2024-24680 CVE-2024-27351                      CVE-2024-39329 CVE-2024-39330 CVE-2024-39614 CVE-2024-41989                      CVE-2024-41991 CVE-2024-42005 CVE-2024-45231 CVE-2024-53907                      CVE-2024-56374 CVE-2025-13372 CVE-2025-26699 CVE-2025-32873                      CVE-2025-48432 CVE-2025-57833 CVE-2025-59681 CVE-2025-59682                      CVE-2025-64459 CVE-2025-64460

    Multiple security issues were found in Django, a Python web development     framework, which could result in denial of service, information     disclosure, directory traversal or SQL injection.

    For the oldstable distribution (bookworm), these problems have been fixed     in version 3:3.2.25-0+deb12u1. python-django-storages also needed to be     updated to ensure ongoing compatibility (1.13.2-1+deb12u1).

    We recommend that you upgrade your python-django packages.

    For the detailed security status of python-django please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/python-django

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
226971	Linux Distros Unpatched Vulnerability : CVE-2023-43665	Nessus	Misc.	2025/3/5	2026/2/15	high
182574	FreeBSD : Django -- multiple vulnerabilities (4f254817-6318-11ee-b2ff-080027de9982)	Nessus	FreeBSD Local Security Checks	2023/10/5	2023/11/14	high
185323	Fedora 39 : python-django (2023-a67af7d8f4)	Nessus	Fedora Local Security Checks	2023/11/7	2024/11/14	high
186583	openSUSE 15 Security Update : python-Django1 (openSUSE-SU-2023:0390-1)	Nessus	SuSE Local Security Checks	2023/12/5	2023/12/5	high
193650	Fedora 38 : python-django3 (2024-84fbbbb914)	Nessus	Fedora Local Security Checks	2024/4/20	2024/11/14	high
194399	RHEL 8 / 9 : Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update (Moderate) (RHSA-2023:6158)	Nessus	Red Hat Local Security Checks	2024/4/28	2024/11/7	critical
299143	Debian dsa-6136 : python-django-doc - security update	Nessus	Debian Local Security Checks	2026/2/15	2026/2/15	critical

检测

插件搜索

high

high

high

high

high

critical

critical