The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4210 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4210-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                           Chris Lamb     June 09, 2025                                 https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : python-django     Version        : 2:2.2.28-1~deb11u7     CVE IDs        : CVE-2025-48432 CVE-2025-32873 CVE-2023-41164 CVE-2023-43665 CVE-2024-24680 CVE-2024-27351     Debian Bugs    : 1107282 1104872 1051226

    A number of vulnerabilities were discovered in Django, a popular     Python-based web-development framework:

     * CVE-2025-48432: Potential log injection via unescaped request path.

       Django's internal HTTP response logging used request.path directly,        allowing control characters (e.g. newlines or ANSI escape sequences) to        be written unescaped into logs. This could enable log injection or        forgery, letting attackers manipulate log appearance or structure,        especially in logs processed by external systems or viewed in terminals.
       (Closes: #1107282)

     * CVE-2025-32873: Denial-of-service possibility in strip_tags()

       django.utils.html.strip_tags() would be slow to evaluate certain inputs        containing large sequences of incomplete HTML tags. This function is used        to implement the striptags template filter, which was therefore also        vulnerable. strip_tags() now raises a SuspiciousOperation exception if it        encounters an unusually large number of unclosed opening tags.
       (Closes: #1104872)

     * CVE-2023-41164: Potential denial of service vulnerability in        django.utils.encoding.uri_to_iri(). This method was subject to potential        denial of service attack via certain inputs with a very large number of        Unicode characters. (Closes: #1051226)

     * CVE-2023-43665: Address a denial-of-service possibility in        django.utils.text.Truncator.

       Following the fix for CVE-2019-14232, the regular expressions used in the        implementation of django.utils.text.Truncator??s chars() and words()        methods (with html=True) were revised and improved. However, these        regular expressions still exhibited linear backtracking complexity, so        when given a very long, potentially malformed HTML input, the evaluation        would still be slow, leading to a potential denial of service        vulnerability. The chars() and words() methods are used to        implement the truncatechars_html and truncatewords_html template        filters, which were thus also vulnerable. The input processed by        Truncator, when operating in HTML mode, has been limited to the        first five million characters in order to avoid potential        performance and memory issues.

     * CVE-2024-24680: Potential denial-of-service in intcomma template        filter. The intcomma template filter was subject to a potential        denial-of-service attack when used with very long strings.

     * CVE-2024-27351: Fix a potential regular expression denial-of-service        (ReDoS) attack in django.utils.text.Truncator.words. This method (with        html=True) and the truncatewords_html template filter were subject to a        potential regular expression denial-of-service attack via a suitably        crafted string. This is, in part, a follow up to CVE-2019-14232 and        CVE-2023-43665.

    For Debian 11 bullseye, these problems have been fixed in version     2:2.2.28-1~deb11u7.

    We recommend that you upgrade your python-django packages.

    For the detailed security status of python-django please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/python-django

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2024:0576 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2024-27351:
    In Django 3.2 before 3.2.25, 4.2 before 4.2.11, and 5.0 before 5.0.3, the     django.utils.text.Truncator.words() method (with html=True) and the truncatewords_html template filter are     subject to a potential regular expression denial-of-service attack via a crafted string. NOTE: this issue     exists because of an incomplete fix for CVE-2019-14232 and CVE-2023-43665.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-6674-2 advisory.

    USN-6674-1 fixed a vulnerability in Django. This update provides the corresponding update for Ubuntu 18.04     LTS.



Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 0ef3398e-da21-11ee-b23a-080027a5b8e9 advisory.

  - Django reports: CVE-2024-27351: Potential regular expression denial-of-service in     django.utils.text.Truncator.words(). (CVE-2024-27351)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 22.04 LTS / 23.10 host has a package installed that is affected by a vulnerability as referenced in the USN-6674-1 advisory.

    Seokchan Yoon discovered that the Django Truncator function incorrectly handled very long HTML input. A     remote attacker could possibly use this issue to cause Django to consume resources, leading to a denial of     service.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2024:0080-1 advisory.

  - Django reports: CVE-2024-27351: Potential regular expression denial-of-service in     django.utils.text.Truncator.words(). (CVE-2024-27351)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-c5c5671edb advisory.

    Automatic update for python-django-4.2.11-1.fc41.

    ##### **Changelog**

    ```
    * Mon Apr  8 2024 Michel Lind <salimma@fedoraproject.org> - 4.2.11-1
    - Update to 4.2.11
    - Resolves CVE-2024-24680 (rhbz#2263505)
    - Resolves CVE-2024-27351 (rhbz#2267654)

    ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:1640 advisory.

    Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing     IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to     individual teams, while automation developers retain the freedom to write tasks that leverage existing     knowledge without the overhead. Ansible Automation Platform makes it possible for users across an     organization to share, vet, and manage automation content by means of a simple, powerful, and agentless     language.

    Security Fix(es):

    * automation-controller: Django: denial-of-service in 'intcomma' template filter (CVE-2024-24680)
    * automation-controller: aiohttp: http request smuggling (CVE-2024-23829)
    * automation-controller: aiohttp: follow_symlinks directory traversal vulnerability (CVE-2024-23334)
    * automation-controller: Jinja2: HTML attribute injection when passing user input as keys to xmlattr     filter (CVE-2024-22195)
    * automation-controller: cryptography: NULL-dereference when loading PKCS7 certificates (CVE-2023-49083)
    * automation-controller: aiohttp: numerous issues in HTTP parser with header parsing (CVE-2023-47627)
    * automation-controller: Twisted: disordered HTTP pipeline response in twisted.web (CVE-2023-46137)
    * automation-controller: axios: exposure of confidential data stored in cookies (CVE-2023-45857)
    * automation-controller: GitPython: Blind local file inclusion (CVE-2023-41040)
    * python3-aiohttp/python39-aiohttp: http request smuggling (CVE-2024-23829)
    * python3-aiohttp/python39-aiohttp: follow_symlinks directory traversal vulnerability (CVE-2024-23334)
    * python3-django/python39-django: Potential regular expression denial-of-service in     django.utils.text.Truncator.words() (CVE-2024-27351)
    * receptor: golang-fips/openssl: Memory leaks in code encrypting and decrypting RSA payloads     (CVE-2024-1394)
    * receptor: golang: net/http/internal: Denial of Service (DoS) via Resource Consumption via HTTP requests     (CVE-2023-39326)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Updates and fixes for automation controller:
    * Fixed bug where schedule prompted variables and survey answers were reset on edit when changing one of     the basic form fields (AAP-20967)
    * Fixed the update execution environment image to no longer fail jobs that use the previous image     (AAP-21733)
    * Removed string validation using comparisons of English literals for comparison, replacing validation     with error/op codes as a universal approach to validation and comparison (AAP-21721)
    * Fixed dispatcher to appropriately terminate child processes when dispatcher terminates (AAP-21049)
    * Fixed upgrade from Ansible Tower 3.8.6 to AAP 2.4 to no longer fail upon database schema migration     (AAP-19738)
    * automation-controller has been updated to 4.5.5

    Updates and fixes for receptor:
    * Fixes a receptor dialing issue where the connection attempt is timed out too aggressively (AAP-21838,     AAP-21828)
    * receptor has been updated to 1.4.5

    Additional fixes:
    * ansible-core has been updated to 2.15.10
    * ansible-runner has been updated to 2.3.6
    * python3-aiohttp/python39-aiohttp has been updated to 3.9.3
    * python3-django/python39-django has been updated  4.2.11
    * python3-pulpcore/python39-pulpcore has been updated 3.28.24

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
238025	Debian dla-4210 : python-django-doc - security update	Nessus	Debian Local Security Checks	2025/6/9	2025/6/9	high
239490	TencentOS Server 4: python-django (TSSA-2024:0576)	Nessus	Tencent Local Security Checks	2025/6/16	2025/12/4	medium
191493	Ubuntu 18.04 LTS : Django vulnerability (USN-6674-2)	Nessus	Ubuntu Local Security Checks	2024/3/4	2024/10/29	medium
191498	FreeBSD : Django -- multiple vulnerabilities (0ef3398e-da21-11ee-b23a-080027a5b8e9)	Nessus	FreeBSD Local Security Checks	2024/3/5	2024/7/4	medium
191500	Ubuntu 20.04 LTS / 22.04 LTS / 23.10 : Django vulnerability (USN-6674-1)	Nessus	Ubuntu Local Security Checks	2024/3/5	2024/8/27	medium
191897	openSUSE 15 Security Update : python-Django1 (openSUSE-SU-2024:0080-1)	Nessus	SuSE Local Security Checks	2024/3/12	2024/7/4	medium
211092	Fedora 41 : python-django (2024-c5c5671edb)	Nessus	Fedora Local Security Checks	2024/11/14	2024/11/14	high
193086	RHEL 8 / 9 : Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update (Moderate) (RHSA-2024:1640)	Nessus	Red Hat Local Security Checks	2024/4/9	2026/1/21	critical

检测

插件搜索

high

medium

medium

medium

medium

medium

high

critical