Detections
Analytics
Debian dla-4484 : python-django-doc - security update
critical Nessus Plugin ID 299630
Synopsis
The remote Debian host is missing one or more security-related updates.Description
The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4484 advisory.- ------------------------------------------------------------------------- Debian LTS Advisory DLA-4484-1 [email protected] https://www.debian.org/lts/security/ Chris Lamb February 19, 2026 https://wiki.debian.org/LTS
- -------------------------------------------------------------------------
Package : python-django Version : 2:2.2.28-1~deb11u12 CVE IDs : CVE-2025-13473 CVE-2026-1207 CVE-2026-1285 CVE-2026-1287 CVE-2026-1312 CVE-2025-6069 CVE-2025-57833
It was discovered that there were multiple vulnerabilities in Django, the Python-based web-development framework:
- - CVE-2025-13473: The check_password function in django.contrib.auth.handlers.modwsgi for authentication via mod_wsgi allowed remote attackers to enumerate users via a timing attack.
- - CVE-2026-1207: Raster lookups on RasterField (only implemented on PostGIS) allowed remote attackers to inject SQL via the band index parameter.
- - CVE-2026-1285: The django.utils.text.Truncator.chars() and Truncator.words() methods (with html=True) and the truncatechars_html and truncatewords_html template filters allowed a remote attacker to cause a potential denial-of-service via crafted inputs containing a large number of unmatched HTML end tags.
- - CVE-2026-1287: FilteredRelation was subject to SQL injection in column aliases via control characters using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to QuerySet methods annotate(), aggregate(), extra(), values(), values_list() and alias().
- - CVE-2026-1312: QuerySet.order_by() was subject to SQL injection in column aliases containing periods when the same alias is, using a suitably crafted dictionary, with dictionary expansion, used in FilteredRelation.
In addition, the fix for CVE-2025-6069 in the python3.9 source package (released as part of a suite of updates in DLA 4445-1) modified Python's html.parser.HTMLParser class in such a way that changed the behaviour of Django's strip_tags() method in some edge cases that were tested by Django's testsuite. As a result of this regression, we have updated the testsuite for the new expected results.
For Debian 11 bullseye, this problem has been fixed in version 2:2.2.28-1~deb11u12.
We recommend that you upgrade your python-django packages.
For the detailed security status of python-django please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/python-django
Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS
Tenable has extracted the preceding description block directly from the Debian security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Upgrade the python-django-doc packages.See Also
http://www.nessus.org/u?22eb32f6
https://packages.debian.org/source/bullseye/python-django
https://security-tracker.debian.org/tracker/CVE-2025-6069
https://security-tracker.debian.org/tracker/CVE-2025-57833
https://security-tracker.debian.org/tracker/CVE-2025-13473
https://security-tracker.debian.org/tracker/CVE-2026-1207
https://security-tracker.debian.org/tracker/CVE-2026-1285
Plugin Details
Severity: Critical
ID: 299630
File Name: debian_DLA-4484.nasl
Version: 1.1
Type: local
Agent: unix
Family: Debian Local Security Checks
Published: 2/19/2026
Updated: 2/19/2026
Supported Sensors: Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Continuous Assessment, Nessus
Risk Information
VPR
Risk Factor: High
Score: 8.4
CVSS v2
Risk Factor: High
Base Score: 7.6
Temporal Score: 6
Vector: CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:C
CVSS Score Source: CVE-2025-57833
CVSS v3
Risk Factor: High
Base Score: 8.1
Temporal Score: 7.3
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C
CVSS v4
Risk Factor: Critical
Base Score: 9.3
Threat Score: 8.9
Threat Vector: CVSS:4.0/E:P
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS Score Source: CVE-2026-1287
Vulnerability Information
CPE: cpe:/o:debian:debian_linux:11.0, p-cpe:/a:debian:debian_linux:python-django-doc, p-cpe:/a:debian:debian_linux:python3-django
Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 2/19/2026
Vulnerability Publication Date: 6/17/2025
Reference Information
CVE: CVE-2025-13473, CVE-2025-57833, CVE-2025-6069, CVE-2026-1207, CVE-2026-1285, CVE-2026-1287, CVE-2026-1312