The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3744 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-3744-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                           Chris Lamb     February 29, 2024                             https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : python-django     Version        : 1:1.11.29-1+deb10u11     CVE IDs        : CVE-2021-28658 CVE-2021-31542 CVE-2021-33203 CVE-2021-33571     Debian Bugs    : 986447 988053 989394

    It was discovered that there were a number of issues in Django, a     popular Python-based web development framework:

     * CVE-2021-28658: Prevent a directory traversal issue which could        have been exploited by maliciously crafted filenames. However, the        built-in upload handlers were not affected by this vulnerability.
       (#986447)

     * CVE-2021-31542: Fix a potential directory-traversal vulnerability        that could have been exploited by uploaded files. The        MultiPartParser, UploadedFile and FieldFile classes allowed        directory-traversal via uploaded files with suitably crafted file        names. In order to mitigate this risk, stricter basename and path        sanitation is now applied. Specifically, empty file names and        paths with dot segments are rejected. (#988053)

     * CVE-2021-33203: Prevent a potential directory traversal via        admindocs. Staff members could use the admindocs        TemplateDetailView view to check the existence of arbitrary files.
       Additionally, if (and only if) the default admindocs templates        have been customized by the developers to also expose the file        contents, then not only the existence but also the file contents        would have been exposed. As a mitigation, path sanitation is now        applied and only files within the template root directories can be        loaded. (#989394)

     * CVE-2021-33571: Prevent possible SSRF, RFI (Remote File Inclusion)        and LFI (Local File Inclusion) attacks, since validators accepted        leading zeros in IPv4 addresses URLValidator,        validate_ipv4_address() and validate_ipv46_address() did not        prohibit leading zeros in octal literals. (#989394)

    For Debian 10 buster, these problems have been fixed in version     1:1.11.29-1+deb10u11.

    We recommend that you upgrade your python-django packages.

    For the detailed security status of python-django please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/python-django

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Debian dla-3744 : python-django - security update

high Nessus Plugin ID 191437

Version 1.1

Version 1.0

Version 1.1 Jan 22, 2025, 8:38 PM CVSS metrics ("Cvssv4 score" set to 0.0) CVSSv2 severity (based on None, severity decreased from "High" to "Low") Plugin metadata Plugin Feed: 202501222038
Version 1.0 Mar 1, 2024, 2:06 AM New Plugin Feed: 202403010206