django-filter is a generic system for filtering Django QuerySets based on user selections. In django-filter before version 2.4.0, automatically generated `NumberFilter` instances, whose value was later converted to an integer, were subject to potential DoS from maliciously input using exponential format with sufficiently large exponents. Version 2.4.0+ applies a `MaxValueValidator` with a a default `limit_value` of 1e50 to the form field used by `NumberFilter` instances. In addition, `NumberFilter` implements the new `get_max_validator()` which should return a configured validator instance to customise the limit, or else `None` to disable the additional validation. Users may manually apply an equivalent validator if they are not able to upgrade.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - django-filter is a generic system for filtering Django QuerySets based on user selections. In django-     filter before version 2.4.0, automatically generated `NumberFilter` instances, whose value was later     converted to an integer, were subject to potential DoS from maliciously input using exponential format     with sufficiently large exponents. Version 2.4.0+ applies a `MaxValueValidator` with a a default     `limit_value` of 1e50 to the form field used by `NumberFilter` instances. In addition, `NumberFilter`     implements the new `get_max_validator()` which should return a configured validator instance to customise     the limit, or else `None` to disable the additional validation. Users may manually apply an equivalent     validator if they are not able to upgrade. (CVE-2020-15225)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - django-filter is a generic system for filtering Django QuerySets based on user selections. In django-
    filter before version 2.4.0, automatically generated `NumberFilter` instances, whose value was later
    converted to an integer, were subject to potential DoS from maliciously input using exponential format
    with sufficiently large exponents. Version 2.4.0+ applies a `MaxValueValidator` with a a default
    `limit_value` of 1e50 to the form field used by `NumberFilter` instances. In addition, `NumberFilter`
    implements the new `get_max_validator()` which should return a configured validator instance to customise
    the limit, or else `None` to disable the additional validation. Users may manually apply an equivalent
    validator if they are not able to upgrade. (CVE-2020-15225)

The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-4dee6d0a76 advisory.

    New upstream version

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
257739	Linux Distros Unpatched Vulnerability : CVE-2020-15225	Nessus	Misc.	medium
420356	SCA: security update for django-filter (GHSA-x7gm-rfgv-w973)	Tenable Cloud Security	SCA Checks	high
420356	SCA: security update for django-filter (GHSA-x7gm-rfgv-w973)	Tenable Self-Hosted Container Security	SCA Checks	high
177333	Fedora 38 : python-django-filter (2023-4dee6d0a76)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2020-15225

high

Tenable Plugins

medium

high

high

medium