The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:0915 advisory.

    Django is a high-level Python Web framework that encourages rapid     development and a clean, pragmatic design. It focuses on automating as much     as possible and adhering to the DRY (Don't Repeat Yourself) principle.

    Security Fix(es):

    * potential data leakage via malformed memcached keys (CVE-2020-13254)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE     page listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:0933 advisory.

    Django is a high-level Python Web framework that encourages rapid     development and a clean, pragmatic design. It focuses on automating as much     as possible and adhering to the DRY (Don't Repeat Yourself) principle.

    Security Fix(es):

    * potential data leakage via malformed memcached keys (CVE-2020-13254)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE     page listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Django security release reports :

CVE-2020-13254: Potential data leakage via malformed memcached keys

In cases where a memcached backend does not perform key validation, passing malformed cache keys could result in a key collision, and potential data leakage. In order to avoid this vulnerability, key validation is added to the memcached cache backends.

CVE-2020-13596: Possible XSS via admin ForeignKeyRawIdWidget

Query parameters for the admin ForeignKeyRawIdWidget were not properly URL encoded, posing an XSS attack vector. ForeignKeyRawIdWidget now ensures query parameters are correctly URL encoded.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4381-1 advisory.

    Dan Palmer discovered that Django incorrectly validated memcached cache keys. A remote attacker could     possibly use this issue to cause a denial of service and obtain sensitive information. (CVE-2020-13254)

    Jon Dufresne discovered that Django incorrectly encoded query parameters for the admin     ForeignKeyRawIdWidget. A remote attacker could possibly use this issue to perform XSS attacks.
    (CVE-2020-13596)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

- Security fix for CVE-2020-7471.

  - Security fix for CVE-2020-9402.

  - Security fix for CVE-2020-13254.

  - Security fix for CVE-2020-13596.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that there was a regression in the latest update to Django, the Python web development framework. The upstream fix for CVE-2020-13254 to address data leakages via malformed memcached keys could, in some situations, cause a traceback.

Please see <https://code.djangoproject.com/ticket/31654> for more information.

For Debian 8 'Jessie', this issue has been fixed in python-django version 1.7.11-1+deb8u10.

We recommend that you upgrade your python-django packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that Django, a high-level Python web development framework, did not properly sanitize input. This would allow a remote attacker to perform SQL injection attacks, Cross-Site Scripting (XSS) attacks, or leak sensitive information.

ID	Name	Product	Family	Published	Updated	Severity
147866	RHEL 8 : Red Hat OpenStack Platform 16.1.4 (python-django) (RHSA-2021:0915)	Nessus	Red Hat Local Security Checks	3/17/2021	11/7/2024	medium
147879	RHEL 7 : python-django (RHSA-2021:0933)	Nessus	Red Hat Local Security Checks	3/18/2021	11/7/2024	medium
137166	FreeBSD : Django -- multiple vulnerabilities (597d02ce-a66c-11ea-af32-080027846a02)	Nessus	FreeBSD Local Security Checks	6/5/2020	9/28/2020	medium
137133	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : Django vulnerabilities (USN-4381-1)	Nessus	Ubuntu Local Security Checks	6/4/2020	8/27/2024	medium
137686	Fedora 32 : python-django (2020-c2639662af)	Nessus	Fedora Local Security Checks	6/22/2020	3/6/2024	critical
137153	Debian DLA-2233-2 : python-django regression update	Nessus	Debian Local Security Checks	6/5/2020	3/7/2024	medium
137680	Fedora 31 : python-django (2020-2e7d30f7aa)	Nessus	Fedora Local Security Checks	6/22/2020	3/6/2024	critical
137673	Debian DSA-4705-1 : python-django - security update	Nessus	Debian Local Security Checks	6/22/2020	9/25/2020	high

Detections

Analytics

Plugins Search

medium

medium

medium

medium

critical

medium

critical

high