In Django 2.2 before 2.2.22, 3.1 before 3.1.10, and 3.2 before 3.2.2 (with Python 3.9.5+), URLValidator does not prohibit newlines and tabs (unless the URLField form field is used). If an application uses values with newlines in an HTTP response, header injection can occur. Django itself is unaffected because HttpResponse prohibits newlines in HTTP headers.

The remote host is affected by the vulnerability described in GLSA-202509-03 (Django: Multiple Vulnerabilities)

    Multiple vulnerabilities have been discovered in Django. Please review the CVE identifiers referenced     below for details.

Tenable has extracted the preceding description block directly from the Gentoo Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2024:0574 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2024-42005:
    An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. QuerySet.values() and     values_list() methods on models with a JSONField are subject to SQL injection in column aliases via a     crafted JSON object key as a passed *arg.

    CVE-2024-41991:
    An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The urlize and urlizetrunc     template filters, and the AdminURLFieldWidget widget, are subject to a potential denial-of-service attack     via certain inputs with a very large number of Unicode characters.

    CVE-2024-41990:
    An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The urlize() and urlizetrunc()     template filters are subject to a potential denial-of-service attack via very large inputs with a specific     sequence of characters.

    CVE-2024-41989:
    An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The floatformat template filter     is subject to significant memory consumption when given a string representation of a number in scientific     notation with a large exponent.

    CVE-2024-39614:
    An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. get_supported_language_variant()     was subject to a potential denial-of-service attack when used with very long strings containing specific     characters.

    CVE-2024-39330:
    An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. Derived classes of the     django.core.files.storage.Storage base class, when they override generate_filename() without replicating     the file-path validations from the parent class, potentially allow directory traversal via certain inputs     during a save() call. (Built-in Storage sub-classes are unaffected.)

    CVE-2024-39329:
    An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. The     django.contrib.auth.backends.ModelBackend.authenticate() method allows remote attackers to enumerate users     via a timing attack involving login requests for users with an unusable password.

    CVE-2024-38875:
    An issue was discovered in Django 4.2 before 4.2.14 and 5.0 before 5.0.7. urlize and urlizetrunc were     subject to a potential denial of service attack via certain inputs with a very large number of brackets.

    CVE-2022-28347:
    A SQL injection issue was discovered in QuerySet.explain() in Django 2.2 before 2.2.28, 3.2 before 3.2.13,     and 4.0 before 4.0.4. This occurs by passing a crafted dictionary (with dictionary expansion) as the
    **options argument, and placing the injection payload in an option name.

    CVE-2022-28346:
    An issue was discovered in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4.
    QuerySet.annotate(), aggregate(), and extra() methods are subject to SQL injection in column aliases via a     crafted dictionary (with dictionary expansion) as the passed **kwargs.

    CVE-2021-33203:
    Django before 2.2.24, 3.x before 3.1.12, and 3.2.x before 3.2.4 has a potential directory traversal via     django.contrib.admindocs. Staff members could use the TemplateDetailView view to check the existence of     arbitrary files. Additionally, if (and only if) the default admindocs templates have been customized by     application developers to also show file contents, then not only the existence but also the file contents     would have been exposed. In other words, there is directory traversal outside of the template root     directories.

    CVE-2021-32052:
    In Django 2.2 before 2.2.22, 3.1 before 3.1.10, and 3.2 before 3.2.2 (with Python 3.9.5+), URLValidator     does not prohibit newlines and tabs (unless the URLField form field is used). If an application uses     values with newlines in an HTTP response, header injection can occur. Django itself is unaffected because     HttpResponse prohibits newlines in HTTP headers.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - In Django 2.2 before 2.2.22, 3.1 before 3.1.10, and 3.2 before 3.2.2 (with Python 3.9.5+), URLValidator
    does not prohibit newlines and tabs (unless the URLField form field is used). If an application uses
    values with newlines in an HTTP response, header injection can occur. Django itself is unaffected because
    HttpResponse prohibits newlines in HTTP headers. (CVE-2021-32052)

The remote SUSE Linux SUSE15 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2023:0005-1 advisory.

  - In Django 2.2 before 2.2.22, 3.1 before 3.1.10, and 3.2 before 3.2.2 (with Python 3.9.5+), URLValidator     does not prohibit newlines and tabs (unless the URLField form field is used). If an application uses     values with newlines in an HTTP response, header injection can occur. Django itself is unaffected because     HttpResponse prohibits newlines in HTTP headers. (CVE-2021-32052)

  - Django before 2.2.24, 3.x before 3.1.12, and 3.2.x before 3.2.4 has a potential directory traversal via     django.contrib.admindocs. Staff members could use the TemplateDetailView view to check the existence of     arbitrary files. Additionally, if (and only if) the default admindocs templates have been customized by     application developers to also show file contents, then not only the existence but also the file contents     would have been exposed. In other words, there is directory traversal outside of the template root     directories. (CVE-2021-33203)

  - In Django 2.2 before 2.2.24, 3.x before 3.1.12, and 3.2 before 3.2.4, URLValidator, validate_ipv4_address,     and validate_ipv46_address do not prohibit leading zero characters in octal literals. This may allow a     bypass of access control that is based on IP addresses. (validate_ipv4_address and validate_ipv46_address     are unaffected with Python 3.9.5+..) . (CVE-2021-33571)

  - In Django 2.2 before 2.2.25, 3.1 before 3.1.14, and 3.2 before 3.2.10, HTTP requests for URLs with     trailing newlines could bypass upstream access control based on URL paths. (CVE-2021-44420)

  - An issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1.
    UserAttributeSimilarityValidator incurred significant overhead in evaluating a submitted password that was     artificially large in relation to the comparison values. In a situation where access to user registration     was unrestricted, this provided a potential vector for a denial-of-service attack. (CVE-2021-45115)

  - An issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. Due to     leveraging the Django Template Language's variable resolution logic, the dictsort template filter was     potentially vulnerable to information disclosure, or an unintended method call, if passed a suitably     crafted key. (CVE-2021-45116)

  - Storage.save in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1 allows directory     traversal if crafted filenames are directly passed to it. (CVE-2021-45452)

  - The {% debug %} template tag in Django 2.2 before 2.2.27, 3.2 before 3.2.12, and 4.0 before 4.0.2 does not     properly encode the current context. This may lead to XSS. (CVE-2022-22818)

  - An issue was discovered in MultiPartParser in Django 2.2 before 2.2.27, 3.2 before 3.2.12, and 4.0 before     4.0.2. Passing certain inputs to multipart forms could result in an infinite loop when parsing files.
    (CVE-2022-23833)

  - An issue was discovered in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4.
    QuerySet.annotate(), aggregate(), and extra() methods are subject to SQL injection in column aliases via a     crafted dictionary (with dictionary expansion) as the passed **kwargs. (CVE-2022-28346)

  - A SQL injection issue was discovered in QuerySet.explain() in Django 2.2 before 2.2.28, 3.2 before 3.2.13,     and 4.0 before 4.0.4. This occurs by passing a crafted dictionary (with dictionary expansion) as the
    **options argument, and placing the injection payload in an option name. (CVE-2022-28347)

  - An issue was discovered in the HTTP FileResponse class in Django 3.2 before 3.2.15 and 4.0 before 4.0.7.
    An application is vulnerable to a reflected file download (RFD) attack that sets the Content-Disposition     header of a FileResponse when the filename is derived from user-supplied input. (CVE-2022-36359)

  - In Django 3.2 before 3.2.16, 4.0 before 4.0.8, and 4.1 before 4.1.2, internationalized URLs were subject     to a potential denial of service attack via the locale parameter, which is treated as a regular     expression. (CVE-2022-41323)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5373-2 advisory.

    USN-5373-1 fixed several vulnerabilities in Django. This update provides the corresponding update for     Ubuntu 14.04 ESM and Ubuntu 16.04 ESM.



Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5373-1 advisory.

    It was discovered that Django incorrectly handled certain certain column aliases in the     QuerySet.annotate(), aggregate(), and extra() methods. A remote attacker could possibly use this issue to     perform an SQL injection attack. (CVE-2022-28346)

    It was discovered that Django incorrectly handled certain option names in the QuerySet.explain() method. A     remote attacker could possibly use this issue to perform an SQL injection attack. This issue only affected     Ubuntu 20.04 LTS, and Ubuntu 21.10. (CVE-2022-28347)

    It was discovered that the Django URLValidator function incorrectly handled newlines and tabs. A remote     attacker could possibly use this issue to perform a header injection attack. This issue only affected     Ubuntu 18.04 LTS. (CVE-2021-32052)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4975-1 advisory.

    It was discovered that the Django URLValidator function incorrectly handled newlines and tabs. A remote     attacker could possibly use this issue to perform a header injection attack. This issue only affected     Ubuntu 20.04 LTS, Ubuntu 20.10, and Ubuntu 21.04. (CVE-2021-32052)

    Rasmus Lerchedahl Petersen and Rasmus Wriedt Larsen discovered that Django incorrectly handled path     sanitation in admindocs. A remote attacker could possibly use this issue to determine the existence of     arbitrary files and in certain configurations obtain their contents. (CVE-2021-33203)

    It was discovered that Django incorrectly handled IPv4 addresses with leading zeros. A remote attacker     could possibly use this issue to perform a wide variety of attacks, including bypassing certain access     restrictions. (CVE-2021-33571)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
265369	GLSA-202509-03 : Django: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	Local	critical
238682	TencentOS Server 4: python-django (TSSA-2024:0574)	Nessus	Tencent Local Security Checks	Local	critical
418197	SCA: security update for Django (GHSA-qm57-vhq3-3fwf)	Tenable Cloud Security	SCA Checks	Local	medium
418197	SCA: security update for Django (GHSA-qm57-vhq3-3fwf)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
169481	openSUSE 15 Security Update : python-Django (openSUSE-SU-2023:0005-1)	Nessus	SuSE Local Security Checks	Local	critical
159639	Ubuntu 16.04 ESM : Django vulnerabilities (USN-5373-2)	Nessus	Ubuntu Local Security Checks	Local	critical
159630	Ubuntu 18.04 LTS / 20.04 LTS : Django vulnerabilities (USN-5373-1)	Nessus	Ubuntu Local Security Checks	Local	critical
150144	Ubuntu 18.04 LTS / 20.04 LTS : Django vulnerabilities (USN-4975-1)	Nessus	Ubuntu Local Security Checks	Local	high

Detections

Analytics

CVE-2021-32052

medium

Tenable Plugins

critical

critical

medium

medium

critical

critical

critical

high