CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
Percentile
95.7%
The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5254 advisory.
The {% debug %} template tag in Django 2.2 before 2.2.27, 3.2 before 3.2.12, and 4.0 before 4.0.2 does not properly encode the current context. This may lead to XSS. (CVE-2022-22818)
An issue was discovered in MultiPartParser in Django 2.2 before 2.2.27, 3.2 before 3.2.12, and 4.0 before 4.0.2. Passing certain inputs to multipart forms could result in an infinite loop when parsing files.
(CVE-2022-23833)
An issue was discovered in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4.
QuerySet.annotate(), aggregate(), and extra() methods are subject to SQL injection in column aliases via a crafted dictionary (with dictionary expansion) as the passed **kwargs. (CVE-2022-28346)
A SQL injection issue was discovered in QuerySet.explain() in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4. This occurs by passing a crafted dictionary (with dictionary expansion) as the
**options argument, and placing the injection payload in an option name. (CVE-2022-28347)
An issue was discovered in Django 3.2 before 3.2.14 and 4.0 before 4.0.6. The Trunc() and Extract() database functions are subject to SQL injection if untrusted data is used as a kind/lookup_name value.
Applications that constrain the lookup name and kind choice to a known safe list are unaffected.
(CVE-2022-34265)
An issue was discovered in the HTTP FileResponse class in Django 3.2 before 3.2.15 and 4.0 before 4.0.7.
An application is vulnerable to a reflected file download (RFD) attack that sets the Content-Disposition header of a FileResponse when the filename is derived from user-supplied input. (CVE-2022-36359)
Django reports: CVE-2022-41323: Potential denial-of-service vulnerability in internationalized URLs. (CVE-2022-41323)
Note that Nessus has not tested for these issues but has instead relied only on the application’s self-reported version number.
#%NASL_MIN_LEVEL 80900
#
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Debian Security Advisory dsa-5254. The text
# itself is copyright (C) Software in the Public Interest, Inc.
#
include('compat.inc');
if (description)
{
script_id(166158);
script_version("1.3");
script_set_attribute(attribute:"plugin_modification_date", value:"2023/10/09");
script_cve_id(
"CVE-2022-22818",
"CVE-2022-23833",
"CVE-2022-28346",
"CVE-2022-28347",
"CVE-2022-34265",
"CVE-2022-36359",
"CVE-2022-41323"
);
script_name(english:"Debian DSA-5254-1 : python-django - security update");
script_set_attribute(attribute:"synopsis", value:
"The remote Debian host is missing one or more security-related updates.");
script_set_attribute(attribute:"description", value:
"The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the
dsa-5254 advisory.
- The {% debug %} template tag in Django 2.2 before 2.2.27, 3.2 before 3.2.12, and 4.0 before 4.0.2 does not
properly encode the current context. This may lead to XSS. (CVE-2022-22818)
- An issue was discovered in MultiPartParser in Django 2.2 before 2.2.27, 3.2 before 3.2.12, and 4.0 before
4.0.2. Passing certain inputs to multipart forms could result in an infinite loop when parsing files.
(CVE-2022-23833)
- An issue was discovered in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4.
QuerySet.annotate(), aggregate(), and extra() methods are subject to SQL injection in column aliases via a
crafted dictionary (with dictionary expansion) as the passed **kwargs. (CVE-2022-28346)
- A SQL injection issue was discovered in QuerySet.explain() in Django 2.2 before 2.2.28, 3.2 before 3.2.13,
and 4.0 before 4.0.4. This occurs by passing a crafted dictionary (with dictionary expansion) as the
**options argument, and placing the injection payload in an option name. (CVE-2022-28347)
- An issue was discovered in Django 3.2 before 3.2.14 and 4.0 before 4.0.6. The Trunc() and Extract()
database functions are subject to SQL injection if untrusted data is used as a kind/lookup_name value.
Applications that constrain the lookup name and kind choice to a known safe list are unaffected.
(CVE-2022-34265)
- An issue was discovered in the HTTP FileResponse class in Django 3.2 before 3.2.15 and 4.0 before 4.0.7.
An application is vulnerable to a reflected file download (RFD) attack that sets the Content-Disposition
header of a FileResponse when the filename is derived from user-supplied input. (CVE-2022-36359)
- Django reports: CVE-2022-41323: Potential denial-of-service vulnerability in internationalized
URLs. (CVE-2022-41323)
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
script_set_attribute(attribute:"see_also", value:"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1004752");
# https://security-tracker.debian.org/tracker/source-package/python-django
script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?22eb32f6");
script_set_attribute(attribute:"see_also", value:"https://www.debian.org/security/2022/dsa-5254");
script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2022-22818");
script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2022-23833");
script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2022-28346");
script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2022-28347");
script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2022-34265");
script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2022-36359");
script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2022-41323");
script_set_attribute(attribute:"see_also", value:"https://packages.debian.org/source/bullseye/python-django");
script_set_attribute(attribute:"solution", value:
"Upgrade the python-django packages.
For the stable distribution (bullseye), these problems have been fixed in version 2");
script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
script_set_attribute(attribute:"cvss_score_source", value:"CVE-2022-34265");
script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
script_set_attribute(attribute:"exploit_available", value:"true");
script_set_attribute(attribute:"vuln_publication_date", value:"2022/02/01");
script_set_attribute(attribute:"patch_publication_date", value:"2022/10/15");
script_set_attribute(attribute:"plugin_publication_date", value:"2022/10/16");
script_set_attribute(attribute:"plugin_type", value:"local");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:python-django-doc");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:python3-django");
script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:11.0");
script_end_attributes();
script_category(ACT_GATHER_INFO);
script_family(english:"Debian Local Security Checks");
script_copyright(english:"This script is Copyright (C) 2022-2023 and is owned by Tenable, Inc. or an Affiliate thereof.");
script_dependencies("ssh_get_info.nasl");
script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l");
exit(0);
}
include('debian_package.inc');
if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING);
var release = get_kb_item('Host/Debian/release');
if ( isnull(release) ) audit(AUDIT_OS_NOT, 'Debian');
var release = chomp(release);
if (! preg(pattern:"^(11)\.[0-9]+", string:release)) audit(AUDIT_OS_NOT, 'Debian 11.0', 'Debian ' + release);
var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Debian', cpu);
var pkgs = [
{'release': '11.0', 'prefix': 'python-django-doc', 'reference': '2:2.2.28-1~deb11u1'},
{'release': '11.0', 'prefix': 'python3-django', 'reference': '2:2.2.28-1~deb11u1'}
];
var flag = 0;
foreach package_array ( pkgs ) {
var release = NULL;
var prefix = NULL;
var reference = NULL;
if (!empty_or_null(package_array['release'])) release = package_array['release'];
if (!empty_or_null(package_array['prefix'])) prefix = package_array['prefix'];
if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];
if (release && prefix && reference) {
if (deb_check(release:release, prefix:prefix, reference:reference)) flag++;
}
}
if (flag)
{
security_report_v4(
port : 0,
severity : SECURITY_HOLE,
extra : deb_report_get()
);
exit(0);
}
else
{
var tested = deb_pkg_tests_get();
if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'python-django-doc / python3-django');
}
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22818
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23833
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-28346
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-28347
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-34265
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-36359
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41323
www.nessus.org/u?22eb32f6
bugs.debian.org/cgi-bin/bugreport.cgi?bug=1004752
packages.debian.org/source/bullseye/python-django
security-tracker.debian.org/tracker/CVE-2022-22818
security-tracker.debian.org/tracker/CVE-2022-23833
security-tracker.debian.org/tracker/CVE-2022-28346
security-tracker.debian.org/tracker/CVE-2022-28347
security-tracker.debian.org/tracker/CVE-2022-34265
security-tracker.debian.org/tracker/CVE-2022-36359
security-tracker.debian.org/tracker/CVE-2022-41323
www.debian.org/security/2022/dsa-5254
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
Percentile
95.7%