An issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17. The strip_tags() method and striptags template filter are subject to a potential denial-of-service attack via certain inputs containing large sequences of nested incomplete HTML entities.

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dla-4006 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4006-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                           Chris Lamb     December 31, 2024                             https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : python-django     Version        : 2:2.2.28-1~deb11u3     CVE ID         : CVE-2024-53907

    It was discovered that there was a potential Denial of Service (DoS)     vulnerability, in Django, a popular Python-based web development     framework.

    The strip_tags() method and striptags template filter were subject to     a potential denial-of-service attack via certain inputs containing     large sequences of nested incomplete HTML entities.

    For Debian 11 bullseye, this problem has been fixed in version     2:2.2.28-1~deb11u3.

    We recommend that you upgrade your python-django packages.

    For the detailed security status of python-django please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/python-django

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / openSUSE 15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:4285-1 advisory.

    - CVE-2024-53907: Fixed denial-of-service in django.utils.html.strip_tags() (bsc#1234232)
      - CVE-2024-53908: Fixed SQL injection in HasKey(lhs, rhs) on Oracle (bsc#1234231)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-7136-2 advisory.

    USN-7136-1 fixed a vulnerability in Django. This update provides the corresponding update for Ubuntu 16.04     LTS and Ubuntu 18.04 LTS.



Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-7136-1 advisory.

    jiangniao discovered that Django incorrectly handled the API to strip tags. A remote attacker could     possibly use this issue to cause Django to consume resources, leading to a denial of service.
    (CVE-2024-53907)

    Seokchan Yoon discovered that Django incorrectly handled HasKey lookups when using Oracle. A remote     attacker could possibly use this issue to inject arbitrary SQL code. This issue only affected Ubuntu 24.04     LTS and Ubuntu 24.10. (CVE-2024-53908)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
213444	Debian dla-4006 : python-django-doc - security update	Nessus	Debian Local Security Checks	high
212730	SUSE SLES15 / openSUSE 15 Security Update : python-Django (SUSE-SU-2024:4285-1)	Nessus	SuSE Local Security Checks	critical
212066	Ubuntu 16.04 LTS / 18.04 LTS : Django vulnerability (USN-7136-2)	Nessus	Ubuntu Local Security Checks	high
212064	Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 : Django vulnerabilities (USN-7136-1)	Nessus	Ubuntu Local Security Checks	critical

Detections

Analytics

CVE-2024-53907

high

Tenable Plugins

high

critical

high

critical