An issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17. Direct usage of the django.db.models.fields.json.HasKey lookup, when an Oracle database is used, is subject to SQL injection if untrusted data is used as an lhs value. (Applications that use the jsonfield.has_key lookup via __ are unaffected.)

The remote host is affected by the vulnerability described in GLSA-202509-03 (Django: Multiple Vulnerabilities)

    Multiple vulnerabilities have been discovered in Django. Please review the CVE identifiers referenced     below for details.

Tenable has extracted the preceding description block directly from the Gentoo Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2024:1101 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2024-53907:
    An issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17. Direct usage     of the django.db.models.fields.json.HasKey lookup, when an Oracle database is used, is subject to SQL     injection if untrusted data is used as an lhs value. (Applications that use the jsonfield.has_key lookup     via __ are unaffected.)

    CVE-2024-53908:
    An issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17. The     strip_tags() method and striptags template filter are subject to a potential denial-of-service attack via     certain inputs containing large sequences of nested incomplete HTML entities.

    CVE-2024-45230:
    An issue was discovered in Django 5.1 before 5.1.1, 5.0 before 5.0.9, and 4.2 before 4.2.16. The urlize()     and urlizetrunc() template filters are subject to a potential denial-of-service attack via very large     inputs with a specific sequence of characters.

    CVE-2024-45231:
    An issue was discovered in Django v5.1.1, v5.0.9, and v4.2.16. The     django.contrib.auth.forms.PasswordResetForm class, when used in a view implementing password reset flows,     allows remote attackers to enumerate user e-mail addresses by sending password reset requests and     observing the outcome (only when e-mail sending is consistently failing).

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - An issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17. The
    strip_tags() method and striptags template filter are subject to a potential denial-of-service attack via
    certain inputs containing large sequences of nested incomplete HTML entities. (CVE-2024-53907)

  - An issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17. Direct usage
    of the django.db.models.fields.json.HasKey lookup, when an Oracle database is used, is subject to SQL
    injection if untrusted data is used as an lhs value. (Applications that use the jsonfield.has_key lookup
    via __ are unaffected.) (CVE-2024-53908)

  - An issue was discovered in Django 5.1 before 5.1.5, 5.0 before 5.0.11, and 4.2 before 4.2.18. Lack of
    upper-bound limit enforcement in strings passed when performing IPv6 validation could lead to a potential
    denial-of-service attack. The undocumented and private functions clean_ipv6_address and
    is_valid_ipv6_address are vulnerable, as is the django.forms.GenericIPAddressField form field. (The
    django.db.models.GenericIPAddressField model field is not affected.) (CVE-2024-56374)

  - An issue was discovered in Django 5.1 before 5.1.7, 5.0 before 5.0.13, and 4.2 before 4.2.20. The
    django.utils.text.wrap() method and wordwrap template filter are subject to a potential denial-of-service
    attack when used with very long strings. (CVE-2025-26699)

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:0721 advisory.

    Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing     IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to     individual teams, while automation developers retain the freedom to write tasks that leverage existing     knowledge without the overhead. Ansible Automation Platform makes it possible for users across an     organization to share, vet, and manage automation content by means of a simple, powerful, and agentless     language.

    Security Fix(es):

    * automation-controller: Jinja has a sandbox breakout through indirect reference to format method     (CVE-2024-56326)
    * automation-controller: Jinja has a sandbox breakout through malicious filenames (CVE-2024-56201)
    * automation-controller: Potential SQL injection in HasKey(lhs, rhs) on Oracle (CVE-2024-53908)
    * python3-jinja2/python39-jinja2: Jinja has a sandbox breakout through indirect reference to format method     (CVE-2024-56326)
    * python3-jinja2/python39-jinja2: Jinja has a sandbox breakout through malicious filenames     (CVE-2024-56201)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Updates and fixes included for automation controller:
    * Fixed an issue where the traceback from host_metric_summary_monthly task caused a type comparison error     (AAP-37486)
    * Fixed an issue where the order of source inventories was not respected by the ansible.controller     collection (AAP-38511)
    * automation-controller has been updated to 4.5.17

    Updates and fixes for installer and setup:
    * Fixed an issue where setting the pg_host= without any other context would result in an empty HOST     section of settings.py in controller (AAP-38030)
    * Fixed an issue where Automation Hub backup would fail when automationhub_pg_port= (AAP-31261)
    * Fixed an issue where providing the database installation a custom port would break the installation of     postgres (AAP-31260)
    * Setup script now warns if provided log path does not have write permission and fails if default path     does not have write permission (AAP-18204)
    * installer and setup have been updated to 2.4-9

    Additional fixes:
    * python3-jinja2/python39-jinja2 has been updated to 3.1.5
    * python3-pulpcore/python39-pulpcore has been updated to 3.28.26

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - An issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17. Direct usage
    of the django.db.models.fields.json.HasKey lookup, when an Oracle database is used, is subject to SQL
    injection if untrusted data is used as an lhs value. (Applications that use the jsonfield.has_key lookup
    via __ are unaffected.) (CVE-2024-53908)

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:0340 advisory.

    Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing     IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to     individual teams, while automation developers retain the freedom to write tasks that leverage existing     knowledge without the overhead. Ansible Automation Platform makes it possible for users across an     organization to share, vet, and manage automation content by means of a simple, powerful, and agentless     language.

    Security Fix(es):
    * automation-controller: Potential SQL injection in HasKey(lhs, rhs) on Oracle (CVE-2024-53908)
    * automation-controller: Potential denial-of-service in django.utils.html.strip_tags() (CVE-2024-53907)
    * automation-controller: Denial of Service through Data corruption in gRPC-C++ (CVE-2024-11407)
    * automation-gateway: nanoid mishandles non-integer values (CVE-2024-55565)
    * python3.11-aiohttp: aiohttp vulnerable to request smuggling due to incorrect parsing of chunk extensions     (CVE-2024-52304)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Updates and fixes included:

    Platform
    * Fixed 'not found' error that occurred occasionally when navigating form wizards (AAP-37495)
    * Fixed an issue where ID_KEY attribute was improperly used to determine the username field in social auth     pipelines (AAP-38300)
    * Fixed an issue where the X-DAB-JW-TOKEN header message would flood logs (AAP-38169)
    * Fixed an issue where authenticator could create a userid and return a non-viable authenticator_uid     (AAP-38021)
    * Enhanced the status API, /api/gateway/v1/status/, from the services property within the JSON to an array     (AAP-37903)
    * Fixes an issue where a private key was displayed in plain text when downloading the OpenAPI schema file.
    NOTE: This was not the private key used by gateway, just a random default key (AAP-37843)

    Automation controller
    * Added 'job_lifecycle' as a choice in loggers to send externally and added 'organization_id' field to     logs related to a job (AAP-37537)
    * Fixed date comparison mismatch for traceback from 'host_metric_summary_monthly' task (AAP-37487)
    * Fixed scheduled jobs with count set to a non-zero value to no longer run unexpectedly (AAP-37290)
    * Fixed the POST operation to '/api/controller/login/' via gateway to no longer result in a fatal error     (AAP-37235)
    * Fixed the behavior of the project's 'requirements.yml' to no longer revert to a prior state in a cluster     (AAP-37228)
    * Fixed occasional error while creating event partition table before starting a job, when lots of jobs are     launched quickly (AAP-37227)
    * Fixed the named URL to no longer return a 404 error code while launching a job template (AAP-37025)
    * Updated receptor to clean up temporary receptor files after a job completes on nodes (AAP-36904)
    * Fixed the POST operation to '/api/controller/login/' via gateway to no longer result in a fatal error     (AAP-33911)
    * automation-controller has been updated to 4.6.6

    Container-based Ansible Automation Platform
    * Fixed an issue where the provided inventory file sample for growth inventories could cause the     installation to stall on low resource systems (AAP-38372)
    * Fixed an issue where the throttle capacity of controller in growth topology installation would allow for     performance degradation (AAP-38207)
    * Fixed an issue where the receptor TLS certificate content was not validated during the preflight role     execution ensuring that the x509 Subject Alt Name (SAN) field contains the required ISO Object Identifier     (OID) (AAP-37880)
    * TLS certificate and key files are now validated during the preflight role execution (AAP-37845)
    * Fixed an issue where the Postgresql SSL mode variables were not validated during the preflight role     execution (AAP-37352)
    * containerized installer setup has been updated to 2.5-8

    RPM-based Ansible Automation Platform
    * Fixed an issue where adding a new automation hub host to upgraded environment has caused the     installation to fail (AAP-38204)
    * Fixed an issue where the link to the documents in the installer README.md was broken (AAP-37627)
    * Updated nginx configuration to properly return API status for Event-Driven Ansible event stream service     (AAP-32816)
    * ansible-automation-platform-installer and installer setup have been updated to 2.5-7

    Additional changes:
    * Installing ansible-core no longer installs python3-jmespath on RHEL 8 (AAP-18251)
    * ansible-core has been updated to 2.16.14-2
    * automation-gateway has been updated to 2.5.20250115
    * python3.11-aiohttp has been updated to 3.10.11 along with its dependencies
    * python3.11-django-ansible-base has been updated to 2.5.20250115
    * python3.11-galaxy-importer has been updated to 0.4.27
    * python3.11-pulpcore has been updated to 3.49.29

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / openSUSE 15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:4285-1 advisory.

    - CVE-2024-53907: Fixed denial-of-service in django.utils.html.strip_tags() (bsc#1234232)
      - CVE-2024-53908: Fixed SQL injection in HasKey(lhs, rhs) on Oracle (bsc#1234231)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-7136-1 advisory.

    jiangniao discovered that Django incorrectly handled the API to strip tags. A remote attacker could     possibly use this issue to cause Django to consume resources, leading to a denial of service.
    (CVE-2024-53907)

    Seokchan Yoon discovered that Django incorrectly handled HasKey lookups when using Oracle. A remote     attacker could possibly use this issue to inject arbitrary SQL code. This issue only affected Ubuntu 24.04     LTS and Ubuntu 24.10. (CVE-2024-53908)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
265369	GLSA-202509-03 : Django: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	critical
239197	TencentOS Server 4: python-django (TSSA-2024:1101)	Nessus	Tencent Local Security Checks	critical
427220	Alpine: multiple py3-django packages: security update to 4.2.20-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
427220	Alpine: multiple py3-django packages: security update to 4.2.20-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
214710	RHEL 8 / 9 : Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update (Important) (RHSA-2025:0721)	Nessus	Red Hat Local Security Checks	medium
416876	SCA: security update for Django, django (GHSA-m9g8-fxxm-xg86)	Tenable Cloud Security	SCA Checks	critical
416876	SCA: security update for Django, django (GHSA-m9g8-fxxm-xg86)	Tenable Self-Hosted Container Security	SCA Checks	critical
214232	RHEL 8 / 9 : Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update (Important) (RHSA-2025:0340)	Nessus	Red Hat Local Security Checks	medium
212730	SUSE SLES15 / openSUSE 15 Security Update : python-Django (SUSE-SU-2024:4285-1)	Nessus	SuSE Local Security Checks	critical
212064	Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 : Django vulnerabilities (USN-7136-1)	Nessus	Ubuntu Local Security Checks	critical

Detections

Analytics

CVE-2024-53908

critical

Tenable Plugins

critical

critical

critical

critical

medium

critical

critical

medium

critical

critical