{"openvas": [{"lastseen": "2019-05-29T18:33:18", "bulletinFamily": "scanner", "cvelist": ["CVE-2018-14574"], "description": "The remote host is missing an update for the ", "modified": "2019-03-18T00:00:00", "published": "2018-08-02T00:00:00", "id": "OPENVAS:1361412562310843604", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310843604", "type": "openvas", "title": "Ubuntu Update for python-django USN-3726-1", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: gb_ubuntu_USN_3726_1.nasl 14288 2019-03-18 16:34:17Z cfischer $\n#\n# Ubuntu Update for python-django USN-3726-1\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2018 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.843604\");\n script_version(\"$Revision: 14288 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-18 17:34:17 +0100 (Mon, 18 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2018-08-02 05:48:36 +0200 (Thu, 02 Aug 2018)\");\n script_cve_id(\"CVE-2018-14574\");\n script_tag(name:\"cvss_base\", value:\"5.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:P/I:P/A:N\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_name(\"Ubuntu Update for python-django USN-3726-1\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'python-django'\n package(s) announced via the referenced advisory.\");\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present\non the target host.\");\n script_tag(name:\"insight\", value:\"Andreas Hug discovered that Django contained\nan open redirect in CommonMiddleware. A remote attacker could possibly use this\nissue to perform phishing attacks.\");\n script_tag(name:\"affected\", value:\"python-django on Ubuntu 18.04 LTS\");\n script_tag(name:\"solution\", value:\"Please install the updated packages.\");\n\n script_xref(name:\"USN\", value:\"3726-1\");\n script_xref(name:\"URL\", value:\"http://www.ubuntu.com/usn/usn-3726-1/\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2018 Greenbone Networks GmbH\");\n script_family(\"Ubuntu Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/ubuntu_linux\", \"ssh/login/packages\", re:\"ssh/login/release=UBUNTU18\\.04 LTS\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-deb.inc\");\n\nrelease = dpkg_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"UBUNTU18.04 LTS\")\n{\n\n if ((res = isdpkgvuln(pkg:\"python-django\", ver:\"1:1.11.11-1ubuntu1.1\", rls:\"UBUNTU18.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"python3-django\", ver:\"1:1.11.11-1ubuntu1.1\", rls:\"UBUNTU18.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}}, {"lastseen": "2020-01-31T17:34:24", "bulletinFamily": "scanner", "cvelist": ["CVE-2018-14574"], "description": "The remote host is missing an update for the ", "modified": "2020-01-31T00:00:00", "published": "2018-10-26T00:00:00", "id": "OPENVAS:1361412562310852035", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310852035", "type": "openvas", "title": "openSUSE: Security Advisory for python-Django1 (openSUSE-SU-2018:2375-1)", "sourceData": "# Copyright (C) 2018 Greenbone Networks GmbH\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (C) of their respective author(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.852035\");\n script_version(\"2020-01-31T08:23:39+0000\");\n script_cve_id(\"CVE-2018-14574\");\n script_tag(name:\"cvss_base\", value:\"5.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:P/I:P/A:N\");\n script_tag(name:\"last_modification\", value:\"2020-01-31 08:23:39 +0000 (Fri, 31 Jan 2020)\");\n script_tag(name:\"creation_date\", value:\"2018-10-26 06:36:06 +0200 (Fri, 26 Oct 2018)\");\n script_name(\"openSUSE: Security Advisory for python-Django1 (openSUSE-SU-2018:2375-1)\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2018 Greenbone Networks GmbH\");\n script_family(\"SuSE Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/suse\", \"ssh/login/rpms\", re:\"ssh/login/release=openSUSELeap15\\.0\");\n\n script_xref(name:\"openSUSE-SU\", value:\"2018:2375-1\");\n script_xref(name:\"URL\", value:\"https://lists.opensuse.org/opensuse-security-announce/2018-08/msg00054.html\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'python-Django1'\n package(s) announced via the openSUSE-SU-2018:2375-1 advisory.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable package version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"This update for python-Django1 to version 1.11.15 fixes the following\n issues:\n\n The following security vulnerability was fixed:\n\n - CVE-2018-14574: Fixed an open redirect possibility in CommonMiddleware\n (boo#1102680)\n\n The following other bugs were fixed:\n\n - Fixed WKBWriter.write() and write_hex() for empty polygons on GEOS 3.6.1+\n\n - Fixed a regression where altering a field with a unique constraint may\n drop and rebuild more foreign keys than necessary\n\n - Fixed crashes in django.contrib.admindocs when a view is a callable\n object, such as django.contrib.syndication.views.Feed\n\n - Fixed a regression where QuerySet.values() or values_list() after\n combining an annotated and unannotated queryset with union(),\n difference(), or intersection() crashed due to mismatching columns\n\n Patch Instructions:\n\n To install this openSUSE Security Update use the SUSE recommended\n installation methods\n like YaST online_update or 'zypper patch'.\n\n Alternatively you can run the command listed for your product:\n\n - openSUSE Leap 15.0:\n\n zypper in -t patch openSUSE-2018-875=1\");\n\n script_tag(name:\"affected\", value:\"python-Django1 on openSUSE Leap 15.0.\");\n\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\nreport = \"\";\n\nif(release == \"openSUSELeap15.0\") {\n if(!isnull(res = isrpmvuln(pkg:\"python2-Django1\", rpm:\"python2-Django1~1.11.15~lp150.2.3.1\", rls:\"openSUSELeap15.0\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if(__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nexit(0);\n", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}}, {"lastseen": "2019-05-29T18:32:13", "bulletinFamily": "scanner", "cvelist": ["CVE-2018-14574"], "description": "The remote host is missing an update for the ", "modified": "2019-05-14T00:00:00", "published": "2019-05-07T00:00:00", "id": "OPENVAS:1361412562310876167", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310876167", "type": "openvas", "title": "Fedora Update for python-django FEDORA-2018-6fa1017c1d", "sourceData": "# Copyright (C) 2019 Greenbone Networks GmbH\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (C) the respective author(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.876167\");\n script_version(\"2019-05-14T05:04:40+0000\");\n script_cve_id(\"CVE-2018-14574\");\n script_tag(name:\"cvss_base\", value:\"5.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:P/I:P/A:N\");\n script_tag(name:\"last_modification\", value:\"2019-05-14 05:04:40 +0000 (Tue, 14 May 2019)\");\n script_tag(name:\"creation_date\", value:\"2019-05-07 02:37:25 +0000 (Tue, 07 May 2019)\");\n script_name(\"Fedora Update for python-django FEDORA-2018-6fa1017c1d\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2019 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\", re:\"ssh/login/release=FC29\");\n\n script_xref(name:\"FEDORA\", value:\"2018-6fa1017c1d\");\n script_xref(name:\"URL\", value:\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HPWXY24APNRSV4TXTNBCYE3DY3UMOY44\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'python-django'\n package(s) announced via the FEDORA-2018-6fa1017c1d advisory.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable package version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"Django is a high-level Python Web framework that encourages rapid\ndevelopment and a clean, pragmatic design. It focuses on automating as\nmuch as possible and adhering to the DRY (Don', t Repeat Yourself)\nprinciple.\");\n\n script_tag(name:\"affected\", value:\"'python-django' package(s) on Fedora 29.\");\n\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\nreport = \"\";\n\nif(release == \"FC29\") {\n\n if(!isnull(res = isrpmvuln(pkg:\"python-django\", rpm:\"python-django~2.0.9~1.fc29\", rls:\"FC29\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if (__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nexit(0);\n", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}}, {"lastseen": "2019-05-29T18:33:01", "bulletinFamily": "scanner", "cvelist": ["CVE-2018-14574"], "description": "The remote host is missing an update for the ", "modified": "2019-03-15T00:00:00", "published": "2018-08-15T00:00:00", "id": "OPENVAS:1361412562310874942", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310874942", "type": "openvas", "title": "Fedora Update for python2-django1.11 FEDORA-2018-0c85690ba7", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: gb_fedora_2018_0c85690ba7_python2-django1.11_fc28.nasl 14223 2019-03-15 13:49:35Z cfischer $\n#\n# Fedora Update for python2-django1.11 FEDORA-2018-0c85690ba7\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2018 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.874942\");\n script_version(\"$Revision: 14223 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-15 14:49:35 +0100 (Fri, 15 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2018-08-15 06:36:18 +0200 (Wed, 15 Aug 2018)\");\n script_cve_id(\"CVE-2018-14574\");\n script_tag(name:\"cvss_base\", value:\"5.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:P/I:P/A:N\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_name(\"Fedora Update for python2-django1.11 FEDORA-2018-0c85690ba7\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'python2-django1.11'\n package(s) announced via the referenced advisory.\");\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present\non the target host.\");\n script_tag(name:\"affected\", value:\"python2-django1.11 on Fedora 28\");\n script_tag(name:\"solution\", value:\"Please install the updated packages.\");\n\n script_xref(name:\"FEDORA\", value:\"2018-0c85690ba7\");\n script_xref(name:\"URL\", value:\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ETE2RUZVTUH2IUTV4XKRJ2P7ZQYKTSKN\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2018 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\", re:\"ssh/login/release=FC28\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"FC28\")\n{\n\n if ((res = isrpmvuln(pkg:\"python2-django1.11\", rpm:\"python2-django1.11~1.11.15~2.fc28\", rls:\"FC28\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}}, {"lastseen": "2020-01-31T17:37:30", "description": "The remote host is missing an update for the ", "cvss3": {}, "published": "2018-10-26T00:00:00", "type": "openvas", "title": "openSUSE: Security Advisory for python-Django (openSUSE-SU-2018:2488-1)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2018-14574"], "modified": "2020-01-31T00:00:00", "id": "OPENVAS:1361412562310852077", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310852077", "sourceData": "# Copyright (C) 2018 Greenbone Networks GmbH\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (C) of their respective author(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.852077\");\n script_version(\"2020-01-31T08:23:39+0000\");\n script_cve_id(\"CVE-2018-14574\");\n script_tag(name:\"cvss_base\", value:\"5.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:P/I:P/A:N\");\n script_tag(name:\"last_modification\", value:\"2020-01-31 08:23:39 +0000 (Fri, 31 Jan 2020)\");\n script_tag(name:\"creation_date\", value:\"2018-10-26 06:42:09 +0200 (Fri, 26 Oct 2018)\");\n script_name(\"openSUSE: Security Advisory for python-Django (openSUSE-SU-2018:2488-1)\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2018 Greenbone Networks GmbH\");\n script_family(\"SuSE Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/suse\", \"ssh/login/rpms\", re:\"ssh/login/release=openSUSELeap15\\.0\");\n\n script_xref(name:\"openSUSE-SU\", value:\"2018:2488-1\");\n script_xref(name:\"URL\", value:\"https://lists.opensuse.org/opensuse-security-announce/2018-08/msg00073.html\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'python-Django'\n package(s) announced via the openSUSE-SU-2018:2488-1 advisory.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable package version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"This update for python-Django to version 2.08 fixes the following issues:\n\n The following security vulnerability was fixed:\n\n - CVE-2018-14574: Fixed an redirection vulnerability in CommonMiddleware\n (boo#1102680)\n\n The following other bugs were fixed:\n\n - Fixed a regression in Django 2.0.7 that broke the regex lookup on MariaDB\n\n - Fixed a regression where django.template.Template crashed if the\n template_string argument is lazy\n\n - Fixed __regex and __iregex lookups with MySQL\n\n - Fixed admin check crash when using a query expression in\n ModelAdmin.ordering\n\n - Fixed admin changelist crash when using a query expression without asc()\n or desc() in the page's ordering\n\n - Fixed a regression that broke custom template filters that use decorators\n\n - Fixed detection of custom URL converters in included pattern\n\n - Fixed a regression that added an unnecessary subquery to the GROUP BY\n clause\n on MySQL when using a RawSQL annotation\n\n - Fixed WKBWriter.write() and write_hex() for empty polygons on GEOS 3.6.1+\n\n - Fixed a regression in Django 1.10 that could result in large memory\n usage when making edits using ModelAdmin.list_editable\n\n - Corrected the import paths that inspectdb generates for\n django.contrib.postgres fields\n\n - Fixed crashes in django.contrib.admindocs when a view is a callable\n object, such as django.contrib.syndication.views.Feed\n\n - Fixed a regression in Django 1.11.12 where QuerySet.values() or\n values_list() after combining an annotated and unannotated queryset with\n union(), difference(), or intersection() crashed due to mismatching\n columns\n\n Patch Instructions:\n\n To install this openSUSE Security Update use the SUSE recommended\n installation methods\n like YaST online_update or 'zypper patch'.\n\n Alternatively you can run the command listed for your product:\n\n - openSUSE Leap 15.0:\n\n zypper in -t patch openSUSE-2018-914=1\");\n\n script_tag(name:\"affected\", value:\"python-Django on openSUSE Leap 15.0.\");\n\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\nreport = \"\";\n\nif(release == \"openSUSELeap15.0\") {\n if(!isnull(res = isrpmvuln(pkg:\"python3-Django\", rpm:\"python3-Django~2.0.8~lp150.2.3.1\", rls:\"openSUSELeap15.0\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if(__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nexit(0);\n", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}}, {"lastseen": "2019-07-04T18:55:36", "bulletinFamily": "scanner", "cvelist": ["CVE-2018-14574"], "description": "Andreas Hug discovered an open redirect in Django, a Python web\ndevelopment framework, which is exploitable if\ndjango.middleware.common.CommonMiddleware\nis used and the\nAPPEND_SLASH setting is enabled.", "modified": "2019-07-04T00:00:00", "published": "2018-08-05T00:00:00", "id": "OPENVAS:1361412562310704264", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310704264", "type": "openvas", "title": "Debian Security Advisory DSA 4264-1 (python-django - security update)", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Auto-generated from advisory DSA 4264-1 using nvtgen 1.0\n# Script version: 1.0\n#\n# Author:\n# Greenbone Networks\n#\n# Copyright:\n# Copyright (c) 2018 Greenbone Networks GmbH http://greenbone.net\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License as published by\n# the Free Software Foundation; either version 2 of the License, or\n# (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.704264\");\n script_version(\"2019-07-04T09:25:28+0000\");\n script_cve_id(\"CVE-2018-14574\");\n script_name(\"Debian Security Advisory DSA 4264-1 (python-django - security update)\");\n script_tag(name:\"last_modification\", value:\"2019-07-04 09:25:28 +0000 (Thu, 04 Jul 2019)\");\n script_tag(name:\"creation_date\", value:\"2018-08-05 00:00:00 +0200 (Sun, 05 Aug 2018)\");\n script_tag(name:\"cvss_base\", value:\"5.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:P/I:P/A:N\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n script_xref(name:\"URL\", value:\"https://www.debian.org/security/2018/dsa-4264.html\");\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2018 Greenbone Networks GmbH http://greenbone.net\");\n script_family(\"Debian Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/debian_linux\", \"ssh/login/packages\", re:\"ssh/login/release=DEB9\");\n script_tag(name:\"affected\", value:\"python-django on Debian Linux\");\n script_tag(name:\"solution\", value:\"For the stable distribution (stretch), this problem has been fixed in\nversion 1:1.10.7-2+deb9u2.\n\nWe recommend that you upgrade your python-django packages.\");\n\n script_xref(name:\"URL\", value:\"https://security-tracker.debian.org/tracker/python-django\");\n script_tag(name:\"summary\", value:\"Andreas Hug discovered an open redirect in Django, a Python web\ndevelopment framework, which is exploitable if\ndjango.middleware.common.CommonMiddleware\nis used and the\nAPPEND_SLASH setting is enabled.\");\n script_tag(name:\"vuldetect\", value:\"This check tests the installed software version using the apt package manager.\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-deb.inc\");\n\nres = \"\";\nreport = \"\";\nif(!isnull(res = isdpkgvuln(pkg:\"python-django\", ver:\"1:1.10.7-2+deb9u2\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"python-django-common\", ver:\"1:1.10.7-2+deb9u2\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"python-django-doc\", ver:\"1:1.10.7-2+deb9u2\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"python3-django\", ver:\"1:1.10.7-2+deb9u2\", rls:\"DEB9\"))) {\n report += res;\n}\n\nif(report != \"\") {\n security_message(data:report);\n} else if(__pkg_match) {\n exit(99);\n}", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}}, {"lastseen": "2019-05-29T18:32:15", "description": "The remote host is missing an update for the ", "cvss3": {}, "published": "2019-03-21T00:00:00", "type": "openvas", "title": "Fedora Update for python2-django1.11 FEDORA-2019-5ad2149e99", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2019-6975", "CVE-2018-14574", "CVE-2019-3498"], "modified": "2019-03-27T00:00:00", "id": "OPENVAS:1361412562310875513", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310875513", "sourceData": "# Copyright (C) 2019 Greenbone Networks GmbH\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (C) the respective author(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.875513\");\n script_version(\"2019-03-27T07:32:46+0000\");\n script_cve_id(\"CVE-2019-3498\", \"CVE-2019-6975\", \"CVE-2018-14574\");\n script_tag(name:\"cvss_base\", value:\"5.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:P/I:P/A:N\");\n script_tag(name:\"last_modification\", value:\"2019-03-27 07:32:46 +0000 (Wed, 27 Mar 2019)\");\n script_tag(name:\"creation_date\", value:\"2019-03-21 09:58:13 +0100 (Thu, 21 Mar 2019)\");\n script_name(\"Fedora Update for python2-django1.11 FEDORA-2019-5ad2149e99\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2019 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\", re:\"ssh/login/release=FC28\");\n\n script_xref(name:\"FEDORA\", value:\"2019-5ad2149e99\");\n script_xref(name:\"URL\", value:\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HVXDOVCXLD74SHR2BENGCE2OOYYYWJHZ\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'python2-django1.11'\n package(s) announced via the FEDORA-2019-5ad2149e99 advisory.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable package version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"This package provides Django in version 1.11 LTS, the last release\nto support Python 2.\n\nDjango is a high-level Python Web framework that encourages rapid\ndevelopment and a clean, pragmatic design. It focuses on automating as\nmuch as possible and adhering to the DRY (Don' t Repeat Yourself)\nprinciple.\");\n\n script_tag(name:\"affected\", value:\"python2-django1.11 on Fedora 28.\");\n\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release) exit(0);\n\nres = \"\";\n\nif(release == \"FC28\")\n{\n\n if((res = isrpmvuln(pkg:\"python2-django1.11\", rpm:\"python2-django1.11~1.11.20~1.fc28\", rls:\"FC28\")) != NULL) {\n security_message(data:res);\n exit(0);\n }\n\n if(__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}}], "suse": [{"lastseen": "2021-06-08T18:43:56", "bulletinFamily": "unix", "cvelist": ["CVE-2018-14574"], "description": "This update for python-Django1 to version 1.11.15 fixes the following\n issues:\n\n The following security vulnerability was fixed:\n\n - CVE-2018-14574: Fixed an open redirect possibility in CommonMiddleware\n (boo#1102680)\n\n The following other bugs were fixed:\n\n - Fixed WKBWriter.write() and write_hex() for empty polygons on GEOS 3.6.1+\n - Fixed a regression where altering a field with a unique constraint may\n drop and rebuild more foreign keys than necessary\n - Fixed crashes in django.contrib.admindocs when a view is a callable\n object, such as django.contrib.syndication.views.Feed\n - Fixed a regression where QuerySet.values() or values_list() after\n combining an annotated and unannotated queryset with union(),\n difference(), or intersection() crashed due to mismatching columns\n\n This update was imported from the openSUSE:Leap:15.0:Update update project.\n\n", "modified": "2018-09-22T09:30:22", "published": "2018-09-22T09:30:22", "id": "OPENSUSE-SU-2018:2809-1", "href": "http://lists.opensuse.org/opensuse-security-announce/2018-09/msg00058.html", "type": "suse", "title": "Security update for python-Django1 (important)", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2021-06-08T18:43:56", "bulletinFamily": "unix", "cvelist": ["CVE-2018-14574"], "description": "This update for python-Django to version 2.08 fixes the following issues:\n\n The following security vulnerability was fixed:\n\n - CVE-2018-14574: Fixed an redirection vulnerability in CommonMiddleware\n (boo#1102680)\n\n The following other bugs were fixed:\n\n - Fixed a regression in Django 2.0.7 that broke the regex lookup on MariaDB\n - Fixed a regression where django.template.Template crashed if the\n template_string argument is lazy\n - Fixed __regex and __iregex lookups with MySQL\n - Fixed admin check crash when using a query expression in\n ModelAdmin.ordering\n - Fixed admin changelist crash when using a query expression without asc()\n or desc() in the page\u00e2\u0080\u0099s ordering\n - Fixed a regression that broke custom template filters that use decorators\n - Fixed detection of custom URL converters in included pattern\n - Fixed a regression that added an unnecessary subquery to the GROUP BY\n clause\n on MySQL when using a RawSQL annotation\n - Fixed WKBWriter.write() and write_hex() for empty polygons on GEOS 3.6.1+\n - Fixed a regression in Django 1.10 that could result in large memory\n usage when making edits using ModelAdmin.list_editable\n - Corrected the import paths that inspectdb generates for\n django.contrib.postgres fields\n - Fixed crashes in django.contrib.admindocs when a view is a callable\n object, such as django.contrib.syndication.views.Feed\n - Fixed a regression in Django 1.11.12 where QuerySet.values() or\n values_list() after combining an annotated and unannotated queryset with\n union(), difference(), or intersection() crashed due to mismatching\n columns\n\n", "modified": "2018-09-22T09:15:44", "published": "2018-09-22T09:15:44", "id": "OPENSUSE-SU-2018:2488-2", "href": "http://lists.opensuse.org/opensuse-security-announce/2018-09/msg00047.html", "type": "suse", "title": "Security update for python-Django (moderate)", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2021-06-08T18:43:56", "bulletinFamily": "unix", "cvelist": ["CVE-2018-14574"], "description": "This update for python-Django1 to version 1.11.15 fixes the following\n issues:\n\n The following security vulnerability was fixed:\n\n - CVE-2018-14574: Fixed an open redirect possibility in CommonMiddleware\n (boo#1102680)\n\n The following other bugs were fixed:\n\n - Fixed WKBWriter.write() and write_hex() for empty polygons on GEOS 3.6.1+\n - Fixed a regression where altering a field with a unique constraint may\n drop and rebuild more foreign keys than necessary\n - Fixed crashes in django.contrib.admindocs when a view is a callable\n object, such as django.contrib.syndication.views.Feed\n - Fixed a regression where QuerySet.values() or values_list() after\n combining an annotated and unannotated queryset with union(),\n difference(), or intersection() crashed due to mismatching columns\n\n", "modified": "2018-08-16T15:21:51", "published": "2018-08-16T15:21:51", "id": "OPENSUSE-SU-2018:2375-1", "href": "http://lists.opensuse.org/opensuse-security-announce/2018-08/msg00054.html", "type": "suse", "title": "Security update for python-Django1 (important)", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2021-06-08T18:43:55", "bulletinFamily": "unix", "cvelist": ["CVE-2018-14574"], "description": "This update for python-Django to 1.11.15 fixes the following issues:\n\n This security issue was fixed:\n\n - CVE-2018-14574: Prevent open redirect in\n django.middleware.common.CommonMiddleware (bsc#1102680).\n\n These non-security issues were fixed:\n\n - Fixed WKBWriter.write() and write_hex() for empty polygons on GEOS 3.6.1+\n - Fixed a regression that could result in large memory usage when making\n edits using ModelAdmin.list_editable\n - Fixed a regression where QuerySet.values() or values_list() after\n combining an annotated and unannotated queryset with union(),\n difference(), or intersection() crashed due to mismatching columns\n - Fixed crashes in django.contrib.admindocs when a view is a callable\n object, such as django.contrib.syndication.views.Feed\n - Fixed a regression where altering a field with a unique constraint may\n drop and rebuild more foreign keys than necessary\n - Fixed a regression where combining two annotated values_list() querysets\n with union(), difference(), or intersection() crashed due to mismatching\n columns\n - Fixed a regression where an empty choice could be initially selected for\n the SelectMultiple and CheckboxSelectMultiple widgets\n\n", "modified": "2018-08-14T21:08:37", "published": "2018-08-14T21:08:37", "id": "OPENSUSE-SU-2018:2327-1", "href": "http://lists.opensuse.org/opensuse-security-announce/2018-08/msg00050.html", "type": "suse", "title": "Security update for python-Django (moderate)", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2021-06-08T18:43:56", "bulletinFamily": "unix", "cvelist": ["CVE-2018-14574"], "description": "This update for python-Django to version 2.08 fixes the following issues:\n\n The following security vulnerability was fixed:\n\n - CVE-2018-14574: Fixed an redirection vulnerability in CommonMiddleware\n (boo#1102680)\n\n The following other bugs were fixed:\n\n - Fixed a regression in Django 2.0.7 that broke the regex lookup on MariaDB\n - Fixed a regression where django.template.Template crashed if the\n template_string argument is lazy\n - Fixed __regex and __iregex lookups with MySQL\n - Fixed admin check crash when using a query expression in\n ModelAdmin.ordering\n - Fixed admin changelist crash when using a query expression without asc()\n or desc() in the page\u00e2\u0080\u0099s ordering\n - Fixed a regression that broke custom template filters that use decorators\n - Fixed detection of custom URL converters in included pattern\n - Fixed a regression that added an unnecessary subquery to the GROUP BY\n clause\n on MySQL when using a RawSQL annotation\n - Fixed WKBWriter.write() and write_hex() for empty polygons on GEOS 3.6.1+\n - Fixed a regression in Django 1.10 that could result in large memory\n usage when making edits using ModelAdmin.list_editable\n - Corrected the import paths that inspectdb generates for\n django.contrib.postgres fields\n - Fixed crashes in django.contrib.admindocs when a view is a callable\n object, such as django.contrib.syndication.views.Feed\n - Fixed a regression in Django 1.11.12 where QuerySet.values() or\n values_list() after combining an annotated and unannotated queryset with\n union(), difference(), or intersection() crashed due to mismatching\n columns\n\n", "modified": "2018-08-24T12:08:21", "published": "2018-08-24T12:08:21", "id": "OPENSUSE-SU-2018:2488-1", "href": "http://lists.opensuse.org/opensuse-security-announce/2018-08/msg00073.html", "type": "suse", "title": "Security update for python-Django (moderate)", "cvss": {"score": 0.0, "vector": "NONE"}}], "debian": [{"lastseen": "2021-10-21T18:33:28", "description": "- -------------------------------------------------------------------------\nDebian Security Advisory DSA-4264-1 security@debian.org\nhttps://www.debian.org/security/ Moritz Muehlenhoff\nAugust 05, 2018 https://www.debian.org/security/faq\n- -------------------------------------------------------------------------\n\nPackage : python-django\nCVE ID : CVE-2018-14574\n\nAndreas Hug discovered an open redirect in Django, a Python web\ndevelopment framework, which is exploitable if\ndjango.middleware.common.CommonMiddleware is used and the APPEND_SLASH\nsetting is enabled.\n\nFor the stable distribution (stretch), this problem has been fixed in\nversion 1:1.10.7-2+deb9u2.\n\nWe recommend that you upgrade your python-django packages.\n\nFor the detailed security status of python-django please refer to\nits security tracker page at:\nhttps://security-tracker.debian.org/tracker/python-django\n\nFurther information about Debian Security Advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: https://www.debian.org/security/\n\nMailing list: debian-security-announce@lists.debian.org", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "baseScore": 6.1, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "userInteraction": "REQUIRED", "version": "3.0"}, "impactScore": 2.7}, "published": "2018-08-05T10:31:21", "type": "debian", "title": "[SECURITY] [DSA 4264-1] python-django security update", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 5.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "acInsufInfo": false, "impactScore": 4.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2018-14574"], "modified": "2018-08-05T10:31:21", "id": "DEBIAN:DSA-4264-1:CB086", "href": "https://lists.debian.org/debian-security-announce/2018/msg00193.html", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}}], "redhatcve": [{"lastseen": "2022-06-08T05:17:12", "description": "When using the django.middleware.common.CommonMiddleware class with the APPEND_SLASH setting enabled, Django projects which accept paths ending in a slash may be vulnerable to an unvalidated HTTP redirect.\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "baseScore": 6.1, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 2.7}, "published": "2018-08-02T02:49:03", "type": "redhatcve", "title": "CVE-2018-14574", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 5.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 4.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2018-14574"], "modified": "2022-06-08T04:57:48", "id": "RH:CVE-2018-14574", "href": "https://access.redhat.com/security/cve/cve-2018-14574", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}}], "nessus": [{"lastseen": "2021-08-19T12:31:22", "description": "This update for python-Django to version 2.08 fixes the following issues :\n\nThe following security vulnerability was fixed :\n\n - CVE-2018-14574: Fixed an redirection vulnerability in CommonMiddleware (boo#1102680)\n\nThe following other bugs were fixed :\n\n - Fixed a regression in Django 2.0.7 that broke the regex lookup on MariaDB\n\n - Fixed a regression where django.template.Template crashed if the template_string argument is lazy\n\n - Fixed __regex and __iregex lookups with MySQL\n\n - Fixed admin check crash when using a query expression in ModelAdmin.ordering\n\n - Fixed admin changelist crash when using a query expression without asc() or desc() in the page’s ordering\n\n - Fixed a regression that broke custom template filters that use decorators\n\n - Fixed detection of custom URL converters in included pattern\n\n - Fixed a regression that added an unnecessary subquery to the GROUP BY clause on MySQL when using a RawSQL annotation\n\n - Fixed WKBWriter.write() and write_hex() for empty polygons on GEOS 3.6.1+\n\n - Fixed a regression in Django 1.10 that could result in large memory usage when making edits using ModelAdmin.list_editable\n\n - Corrected the import paths that inspectdb generates for django.contrib.postgres fields\n\n - Fixed crashes in django.contrib.admindocs when a view is a callable object, such as django.contrib.syndication.views.Feed\n\n - Fixed a regression in Django 1.11.12 where QuerySet.values() or values_list() after combining an annotated and unannotated queryset with union(), difference(), or intersection() crashed due to mismatching columns", "cvss3": {"score": 6.1, "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}, "published": "2018-08-28T00:00:00", "type": "nessus", "title": "openSUSE Security Update : python-Django (openSUSE-2018-914)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2018-14574"], "modified": "2021-01-19T00:00:00", "cpe": ["p-cpe:/a:novell:opensuse:python3-Django", "cpe:/o:novell:opensuse:15.0"], "id": "OPENSUSE-2018-914.NASL", "href": "https://www.tenable.com/plugins/nessus/112137", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from openSUSE Security Update openSUSE-2018-914.\n#\n# The text description of this plugin is (C) SUSE LLC.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(112137);\n script_version(\"1.4\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/19\");\n\n script_cve_id(\"CVE-2018-14574\");\n\n script_name(english:\"openSUSE Security Update : python-Django (openSUSE-2018-914)\");\n script_summary(english:\"Check for the openSUSE-2018-914 patch\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote openSUSE host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"This update for python-Django to version 2.08 fixes the following\nissues :\n\nThe following security vulnerability was fixed :\n\n - CVE-2018-14574: Fixed an redirection vulnerability in\n CommonMiddleware (boo#1102680)\n\nThe following other bugs were fixed :\n\n - Fixed a regression in Django 2.0.7 that broke the regex\n lookup on MariaDB\n\n - Fixed a regression where django.template.Template\n crashed if the template_string argument is lazy\n\n - Fixed __regex and __iregex lookups with MySQL\n\n - Fixed admin check crash when using a query expression in\n ModelAdmin.ordering\n\n - Fixed admin changelist crash when using a query\n expression without asc() or desc() in the page’s\n ordering\n\n - Fixed a regression that broke custom template filters\n that use decorators\n\n - Fixed detection of custom URL converters in included\n pattern\n\n - Fixed a regression that added an unnecessary subquery to\n the GROUP BY clause on MySQL when using a RawSQL\n annotation\n\n - Fixed WKBWriter.write() and write_hex() for empty\n polygons on GEOS 3.6.1+\n\n - Fixed a regression in Django 1.10 that could result in\n large memory usage when making edits using\n ModelAdmin.list_editable\n\n - Corrected the import paths that inspectdb generates for\n django.contrib.postgres fields\n\n - Fixed crashes in django.contrib.admindocs when a view is\n a callable object, such as\n django.contrib.syndication.views.Feed\n\n - Fixed a regression in Django 1.11.12 where\n QuerySet.values() or values_list() after combining an\n annotated and unannotated queryset with union(),\n difference(), or intersection() crashed due to\n mismatching columns\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1102680\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected python-Django package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:N\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:python3-Django\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:opensuse:15.0\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2018/08/24\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2018/08/28\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2018-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release =~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"openSUSE\");\nif (release !~ \"^(SUSE15\\.0)$\") audit(AUDIT_OS_RELEASE_NOT, \"openSUSE\", \"15.0\", release);\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\n\nflag = 0;\n\nif ( rpm_check(release:\"SUSE15.0\", reference:\"python3-Django-2.0.8-lp150.2.3.1\") ) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"python3-Django\");\n}\n", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}}, {"lastseen": "2021-08-19T12:27:59", "description": "This update for python-Django1 to version 1.11.15 fixes the following issues :\n\nThe following security vulnerability was fixed :\n\n - CVE-2018-14574: Fixed an open redirect possibility in CommonMiddleware (boo#1102680)\n\nThe following other bugs were fixed :\n\n - Fixed WKBWriter.write() and write_hex() for empty polygons on GEOS 3.6.1+\n\n - Fixed a regression where altering a field with a unique constraint may drop and rebuild more foreign keys than necessary\n\n - Fixed crashes in django.contrib.admindocs when a view is a callable object, such as django.contrib.syndication.views.Feed\n\n - Fixed a regression where QuerySet.values() or values_list() after combining an annotated and unannotated queryset with union(), difference(), or intersection() crashed due to mismatching columns", "cvss3": {"score": 6.1, "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}, "published": "2019-03-27T00:00:00", "type": "nessus", "title": "openSUSE Security Update : python-Django1 (openSUSE-2019-608)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2018-14574"], "modified": "2021-01-19T00:00:00", "cpe": ["p-cpe:/a:novell:opensuse:python2-Django1", "cpe:/o:novell:opensuse:15.0"], "id": "OPENSUSE-2019-608.NASL", "href": "https://www.tenable.com/plugins/nessus/123266", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from openSUSE Security Update openSUSE-2019-608.\n#\n# The text description of this plugin is (C) SUSE LLC.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(123266);\n script_version(\"1.4\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/19\");\n\n script_cve_id(\"CVE-2018-14574\");\n\n script_name(english:\"openSUSE Security Update : python-Django1 (openSUSE-2019-608)\");\n script_summary(english:\"Check for the openSUSE-2019-608 patch\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote openSUSE host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"This update for python-Django1 to version 1.11.15 fixes the following\nissues :\n\nThe following security vulnerability was fixed :\n\n - CVE-2018-14574: Fixed an open redirect possibility in\n CommonMiddleware (boo#1102680)\n\nThe following other bugs were fixed :\n\n - Fixed WKBWriter.write() and write_hex() for empty\n polygons on GEOS 3.6.1+\n\n - Fixed a regression where altering a field with a unique\n constraint may drop and rebuild more foreign keys than\n necessary\n\n - Fixed crashes in django.contrib.admindocs when a view is\n a callable object, such as\n django.contrib.syndication.views.Feed\n\n - Fixed a regression where QuerySet.values() or\n values_list() after combining an annotated and\n unannotated queryset with union(), difference(), or\n intersection() crashed due to mismatching columns\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1102680\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected python-Django1 package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:python2-Django1\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:opensuse:15.0\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2018/08/03\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2019/03/23\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2019/03/27\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2019-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release =~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"openSUSE\");\nif (release !~ \"^(SUSE15\\.0)$\") audit(AUDIT_OS_RELEASE_NOT, \"openSUSE\", \"15.0\", release);\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\n\nflag = 0;\n\nif ( rpm_check(release:\"SUSE15.0\", reference:\"python2-Django1-1.11.15-lp150.2.3.1\") ) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"python2-Django1\");\n}\n", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}}, {"lastseen": "2021-08-19T12:29:13", "description": "Update to 1.11.15 security release (CVE-2018-14574)\n\nThis fixes an open redirect possibility in CommonMiddleware. Release notes: https://docs.djangoproject.com/en/2.0/releases/1.11.15/\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.\nTenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"score": 6.1, "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}, "published": "2019-01-03T00:00:00", "type": "nessus", "title": "Fedora 28 : python2-django1.11 (2018-0c85690ba7)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2018-14574"], "modified": "2021-01-06T00:00:00", "cpe": ["p-cpe:/a:fedoraproject:fedora:python2-django1.11", "cpe:/o:fedoraproject:fedora:28"], "id": "FEDORA_2018-0C85690BA7.NASL", "href": "https://www.tenable.com/plugins/nessus/120229", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory FEDORA-2018-0c85690ba7.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(120229);\n script_version(\"1.5\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\"CVE-2018-14574\");\n script_xref(name:\"FEDORA\", value:\"2018-0c85690ba7\");\n\n script_name(english:\"Fedora 28 : python2-django1.11 (2018-0c85690ba7)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Update to 1.11.15 security release (CVE-2018-14574)\n\nThis fixes an open redirect possibility in CommonMiddleware. Release\nnotes: https://docs.djangoproject.com/en/2.0/releases/1.11.15/\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora update system website.\nTenable has attempted to automatically clean and format it as much as\npossible without introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bodhi.fedoraproject.org/updates/FEDORA-2018-0c85690ba7\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://docs.djangoproject.com/en/2.0/releases/1.11.15/\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected python2-django1.11 package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:python2-django1.11\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:28\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2018/08/03\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2018/08/14\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2019/01/03\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2019-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = pregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^28([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 28\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\n\nflag = 0;\nif (rpm_check(release:\"FC28\", reference:\"python2-django1.11-1.11.15-2.fc28\")) flag++;\n\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"python2-django1.11\");\n}\n", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}}, {"lastseen": "2021-08-19T12:29:34", "description": "bugfix update to 2.0.9\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.\nTenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"score": 6.1, "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}, "published": "2019-01-03T00:00:00", "type": "nessus", "title": "Fedora 29 : python-django (2018-6fa1017c1d)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2018-14574"], "modified": "2021-01-06T00:00:00", "cpe": ["p-cpe:/a:fedoraproject:fedora:python-django", "cpe:/o:fedoraproject:fedora:29"], "id": "FEDORA_2018-6FA1017C1D.NASL", "href": "https://www.tenable.com/plugins/nessus/120517", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory FEDORA-2018-6fa1017c1d.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(120517);\n script_version(\"1.5\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\"CVE-2018-14574\");\n script_xref(name:\"FEDORA\", value:\"2018-6fa1017c1d\");\n\n script_name(english:\"Fedora 29 : python-django (2018-6fa1017c1d)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"bugfix update to 2.0.9\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora update system website.\nTenable has attempted to automatically clean and format it as much as\npossible without introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bodhi.fedoraproject.org/updates/FEDORA-2018-6fa1017c1d\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected python-django package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:python-django\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:29\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2018/08/03\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2018/11/03\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2019/01/03\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2019-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = pregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^29([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 29\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\n\nflag = 0;\nif (rpm_check(release:\"FC29\", reference:\"python-django-2.0.9-1.fc29\")) flag++;\n\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"python-django\");\n}\n", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}}, {"lastseen": "2021-10-16T00:52:15", "description": "Andreas Hug discovered an open redirect in Django, a Python web development framework, which is exploitable ifdjango.middleware.common.CommonMiddleware is used and the APPEND_SLASH setting is enabled.", "cvss3": {"score": 6.1, "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}, "published": "2018-08-06T00:00:00", "type": "nessus", "title": "Debian DSA-4264-1 : python-django - security update", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2018-14574"], "modified": "2018-11-13T00:00:00", "cpe": ["p-cpe:/a:debian:debian_linux:python-django", "cpe:/o:debian:debian_linux:9.0"], "id": "DEBIAN_DSA-4264.NASL", "href": "https://www.tenable.com/plugins/nessus/111537", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Debian Security Advisory DSA-4264. The text \n# itself is copyright (C) Software in the Public Interest, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(111537);\n script_version(\"1.4\");\n script_cvs_date(\"Date: 2018/11/13 12:30:47\");\n\n script_cve_id(\"CVE-2018-14574\");\n script_xref(name:\"DSA\", value:\"4264\");\n\n script_name(english:\"Debian DSA-4264-1 : python-django - security update\");\n script_summary(english:\"Checks dpkg output for the updated package\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Debian host is missing a security-related update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Andreas Hug discovered an open redirect in Django, a Python web\ndevelopment framework, which is exploitable\nifdjango.middleware.common.CommonMiddleware is used and the\nAPPEND_SLASH setting is enabled.\"\n );\n # https://security-tracker.debian.org/tracker/source-package/python-django\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?22eb32f6\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://packages.debian.org/source/stretch/python-django\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.debian.org/security/2018/dsa-4264\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"Upgrade the python-django packages.\n\nFor the stable distribution (stretch), this problem has been fixed in\nversion 1:1.10.7-2+deb9u2.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:N\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:python-django\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:debian:debian_linux:9.0\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2018/08/05\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2018/08/06\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2018 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Debian Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Debian/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"debian_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Debian/release\")) audit(AUDIT_OS_NOT, \"Debian\");\nif (!get_kb_item(\"Host/Debian/dpkg-l\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\nif (deb_check(release:\"9.0\", prefix:\"python-django\", reference:\"1:1.10.7-2+deb9u2\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"python-django-common\", reference:\"1:1.10.7-2+deb9u2\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"python-django-doc\", reference:\"1:1.10.7-2+deb9u2\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"python3-django\", reference:\"1:1.10.7-2+deb9u2\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:deb_report_get());\n else security_warning(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}}, {"lastseen": "2021-08-19T12:31:21", "description": "This update for python-Django1 to version 1.11.15 fixes the following issues :\n\nThe following security vulnerability was fixed :\n\n - CVE-2018-14574: Fixed an open redirect possibility in CommonMiddleware (boo#1102680)\n\nThe following other bugs were fixed :\n\n - Fixed WKBWriter.write() and write_hex() for empty polygons on GEOS 3.6.1+\n\n - Fixed a regression where altering a field with a unique constraint may drop and rebuild more foreign keys than necessary\n\n - Fixed crashes in django.contrib.admindocs when a view is a callable object, such as django.contrib.syndication.views.Feed\n\n - Fixed a regression where QuerySet.values() or values_list() after combining an annotated and unannotated queryset with union(), difference(), or intersection() crashed due to mismatching columns", "cvss3": {"score": 6.1, "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}, "published": "2018-08-17T00:00:00", "type": "nessus", "title": "openSUSE Security Update : python-Django1 (openSUSE-2018-875)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2018-14574"], "modified": "2021-01-19T00:00:00", "cpe": ["p-cpe:/a:novell:opensuse:python2-Django1", "cpe:/o:novell:opensuse:15.0"], "id": "OPENSUSE-2018-875.NASL", "href": "https://www.tenable.com/plugins/nessus/111810", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from openSUSE Security Update openSUSE-2018-875.\n#\n# The text description of this plugin is (C) SUSE LLC.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(111810);\n script_version(\"1.4\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/19\");\n\n script_cve_id(\"CVE-2018-14574\");\n\n script_name(english:\"openSUSE Security Update : python-Django1 (openSUSE-2018-875)\");\n script_summary(english:\"Check for the openSUSE-2018-875 patch\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote openSUSE host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"This update for python-Django1 to version 1.11.15 fixes the following\nissues :\n\nThe following security vulnerability was fixed :\n\n - CVE-2018-14574: Fixed an open redirect possibility in\n CommonMiddleware (boo#1102680)\n\nThe following other bugs were fixed :\n\n - Fixed WKBWriter.write() and write_hex() for empty\n polygons on GEOS 3.6.1+\n\n - Fixed a regression where altering a field with a unique\n constraint may drop and rebuild more foreign keys than\n necessary\n\n - Fixed crashes in django.contrib.admindocs when a view is\n a callable object, such as\n django.contrib.syndication.views.Feed\n\n - Fixed a regression where QuerySet.values() or\n values_list() after combining an annotated and\n unannotated queryset with union(), difference(), or\n intersection() crashed due to mismatching columns\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1102680\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected python-Django1 package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:N\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:python2-Django1\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:opensuse:15.0\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2018/08/16\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2018/08/17\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2018-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release =~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"openSUSE\");\nif (release !~ \"^(SUSE15\\.0)$\") audit(AUDIT_OS_RELEASE_NOT, \"openSUSE\", \"15.0\", release);\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\n\nflag = 0;\n\nif ( rpm_check(release:\"SUSE15.0\", reference:\"python2-Django1-1.11.15-lp150.2.3.1\") ) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"python2-Django1\");\n}\n", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}}, {"lastseen": "2021-08-19T12:27:42", "description": "This update for python-Django to version 2.08 fixes the following issues :\n\nThe following security vulnerability was fixed :\n\n - CVE-2018-14574: Fixed an redirection vulnerability in CommonMiddleware (boo#1102680)\n\nThe following other bugs were fixed :\n\n - Fixed a regression in Django 2.0.7 that broke the regex lookup on MariaDB\n\n - Fixed a regression where django.template.Template crashed if the template_string argument is lazy\n\n - Fixed __regex and __iregex lookups with MySQL\n\n - Fixed admin check crash when using a query expression in ModelAdmin.ordering\n\n - Fixed admin changelist crash when using a query expression without asc() or desc() in the page’s ordering\n\n - Fixed a regression that broke custom template filters that use decorators\n\n - Fixed detection of custom URL converters in included pattern\n\n - Fixed a regression that added an unnecessary subquery to the GROUP BY clause on MySQL when using a RawSQL annotation\n\n - Fixed WKBWriter.write() and write_hex() for empty polygons on GEOS 3.6.1+\n\n - Fixed a regression in Django 1.10 that could result in large memory usage when making edits using ModelAdmin.list_editable\n\n - Corrected the import paths that inspectdb generates for django.contrib.postgres fields\n\n - Fixed crashes in django.contrib.admindocs when a view is a callable object, such as django.contrib.syndication.views.Feed\n\n - Fixed a regression in Django 1.11.12 where QuerySet.values() or values_list() after combining an annotated and unannotated queryset with union(), difference(), or intersection() crashed due to mismatching columns", "cvss3": {"score": 6.1, "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}, "published": "2019-03-27T00:00:00", "type": "nessus", "title": "openSUSE Security Update : python-Django (openSUSE-2019-614)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2018-14574"], "modified": "2021-01-19T00:00:00", "cpe": ["p-cpe:/a:novell:opensuse:python3-Django", "cpe:/o:novell:opensuse:15.0"], "id": "OPENSUSE-2019-614.NASL", "href": "https://www.tenable.com/plugins/nessus/123267", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from openSUSE Security Update openSUSE-2019-614.\n#\n# The text description of this plugin is (C) SUSE LLC.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(123267);\n script_version(\"1.4\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/19\");\n\n script_cve_id(\"CVE-2018-14574\");\n\n script_name(english:\"openSUSE Security Update : python-Django (openSUSE-2019-614)\");\n script_summary(english:\"Check for the openSUSE-2019-614 patch\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote openSUSE host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"This update for python-Django to version 2.08 fixes the following\nissues :\n\nThe following security vulnerability was fixed :\n\n - CVE-2018-14574: Fixed an redirection vulnerability in\n CommonMiddleware (boo#1102680)\n\nThe following other bugs were fixed :\n\n - Fixed a regression in Django 2.0.7 that broke the regex\n lookup on MariaDB\n\n - Fixed a regression where django.template.Template\n crashed if the template_string argument is lazy\n\n - Fixed __regex and __iregex lookups with MySQL\n\n - Fixed admin check crash when using a query expression in\n ModelAdmin.ordering\n\n - Fixed admin changelist crash when using a query\n expression without asc() or desc() in the page’s\n ordering\n\n - Fixed a regression that broke custom template filters\n that use decorators\n\n - Fixed detection of custom URL converters in included\n pattern\n\n - Fixed a regression that added an unnecessary subquery to\n the GROUP BY clause on MySQL when using a RawSQL\n annotation\n\n - Fixed WKBWriter.write() and write_hex() for empty\n polygons on GEOS 3.6.1+\n\n - Fixed a regression in Django 1.10 that could result in\n large memory usage when making edits using\n ModelAdmin.list_editable\n\n - Corrected the import paths that inspectdb generates for\n django.contrib.postgres fields\n\n - Fixed crashes in django.contrib.admindocs when a view is\n a callable object, such as\n django.contrib.syndication.views.Feed\n\n - Fixed a regression in Django 1.11.12 where\n QuerySet.values() or values_list() after combining an\n annotated and unannotated queryset with union(),\n difference(), or intersection() crashed due to\n mismatching columns\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1102680\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected python-Django package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:python3-Django\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:opensuse:15.0\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2018/08/03\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2019/03/23\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2019/03/27\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2019-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release =~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"openSUSE\");\nif (release !~ \"^(SUSE15\\.0)$\") audit(AUDIT_OS_RELEASE_NOT, \"openSUSE\", \"15.0\", release);\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\n\nflag = 0;\n\nif ( rpm_check(release:\"SUSE15.0\", reference:\"python3-Django-2.0.8-lp150.2.3.1\") ) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"python3-Django\");\n}\n", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}}, {"lastseen": "2021-08-19T12:31:27", "description": "Andreas Hug discovered that Django contained an open redirect in CommonMiddleware. A remote attacker could possibly use this issue to perform phishing attacks.\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"score": 6.1, "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}, "published": "2018-08-02T00:00:00", "type": "nessus", "title": "Ubuntu 18.04 LTS : python-django vulnerability (USN-3726-1)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2018-14574"], "modified": "2019-09-18T00:00:00", "cpe": ["p-cpe:/a:canonical:ubuntu_linux:python-django", "p-cpe:/a:canonical:ubuntu_linux:python3-django", "cpe:/o:canonical:ubuntu_linux:18.04:-:lts"], "id": "UBUNTU_USN-3726-1.NASL", "href": "https://www.tenable.com/plugins/nessus/111511", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Ubuntu Security Notice USN-3726-1. The text \n# itself is copyright (C) Canonical, Inc. See \n# <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered \n# trademark of Canonical, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(111511);\n script_version(\"1.4\");\n script_cvs_date(\"Date: 2019/09/18 12:31:48\");\n\n script_cve_id(\"CVE-2018-14574\");\n script_xref(name:\"USN\", value:\"3726-1\");\n\n script_name(english:\"Ubuntu 18.04 LTS : python-django vulnerability (USN-3726-1)\");\n script_summary(english:\"Checks dpkg output for updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\n\"The remote Ubuntu host is missing one or more security-related\npatches.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Andreas Hug discovered that Django contained an open redirect in\nCommonMiddleware. A remote attacker could possibly use this issue to\nperform phishing attacks.\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Ubuntu security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://usn.ubuntu.com/3726-1/\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected python-django and / or python3-django packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:N\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:python-django\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:python3-django\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:18.04:-:lts\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2018/08/03\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2018/08/01\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2018/08/02\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"Ubuntu Security Notice (C) 2018-2019 Canonical, Inc. / NASL script (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Ubuntu Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/cpu\", \"Host/Ubuntu\", \"Host/Ubuntu/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"ubuntu.inc\");\ninclude(\"misc_func.inc\");\n\nif ( ! get_kb_item(\"Host/local_checks_enabled\") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/Ubuntu/release\");\nif ( isnull(release) ) audit(AUDIT_OS_NOT, \"Ubuntu\");\nrelease = chomp(release);\nif (! preg(pattern:\"^(18\\.04)$\", string:release)) audit(AUDIT_OS_NOT, \"Ubuntu 18.04\", \"Ubuntu \" + release);\nif ( ! get_kb_item(\"Host/Debian/dpkg-l\") ) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Ubuntu\", cpu);\n\nflag = 0;\n\nif (ubuntu_check(osver:\"18.04\", pkgname:\"python-django\", pkgver:\"1:1.11.11-1ubuntu1.1\")) flag++;\nif (ubuntu_check(osver:\"18.04\", pkgname:\"python3-django\", pkgver:\"1:1.11.11-1ubuntu1.1\")) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : ubuntu_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = ubuntu_pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"python-django / python3-django\");\n}\n", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}}, {"lastseen": "2021-08-19T12:28:25", "description": "Updated packages are now available for Red Hat Gluster Storage 3.4 Web Administration Batch Update 3 on Red Hat Enterprise Linux 7.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.\n\nRed Hat Gluster Storage Web Administration includes a fully automated setup based on Ansible and provides deep metrics and insights into active Gluster storage pools by using the Grafana platform. Red Hat Gluster Storage WebAdministration provides a dashboard view which allows an administrator to get a view of overall gluster health in terms of hosts, volumes, bricks, and other components of GlusterFS.\n\nSecurity Fix(es) :\n\n* django: Catastrophic backtracking in regular expressions via 'urlize' and 'urlizetrunc' (CVE-2018-7536)\n\n* django: Catastrophic backtracking in regular expressions via 'truncatechars_html' and 'truncatewords_html' (CVE-2018-7537)\n\n* django: Open redirect possibility in CommonMiddleware (CVE-2018-14574)\n\nFor more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.\n\nRed Hat would like to thank the Django project for reporting CVE-2018-7536 and CVE-2018-7537.\n\nUsers of Red Hat Gluster Storage Web Administration with Red Hat Gluster Storage are advised to upgrade to this updated package to fix these issues.", "cvss3": {"score": 6.1, "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}, "published": "2019-02-06T00:00:00", "type": "nessus", "title": "RHEL 7 : Storage Server (RHSA-2019:0265)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2018-14574", "CVE-2018-7536", "CVE-2018-7537"], "modified": "2020-02-20T00:00:00", "cpe": ["p-cpe:/a:redhat:enterprise_linux:tendrl-collectd-selinux", "p-cpe:/a:redhat:enterprise_linux:tendrl-commons", "p-cpe:/a:redhat:enterprise_linux:tendrl-node-agent", "p-cpe:/a:redhat:enterprise_linux:tendrl-selinux", "cpe:/o:redhat:enterprise_linux:7"], "id": "REDHAT-RHSA-2019-0265.NASL", "href": "https://www.tenable.com/plugins/nessus/121606", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Red Hat Security Advisory RHSA-2019:0265. The text \n# itself is copyright (C) Red Hat, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(121606);\n script_version(\"1.5\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2020/02/20\");\n\n script_cve_id(\"CVE-2018-14574\", \"CVE-2018-7536\", \"CVE-2018-7537\");\n script_xref(name:\"RHSA\", value:\"2019:0265\");\n\n script_name(english:\"RHEL 7 : Storage Server (RHSA-2019:0265)\");\n script_summary(english:\"Checks the rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Red Hat host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Updated packages are now available for Red Hat Gluster Storage 3.4 Web\nAdministration Batch Update 3 on Red Hat Enterprise Linux 7.\n\nRed Hat Product Security has rated this update as having a security\nimpact of Moderate. A Common Vulnerability Scoring System (CVSS) base\nscore, which gives a detailed severity rating, is available for each\nvulnerability from the CVE link(s) in the References section.\n\nRed Hat Gluster Storage Web Administration includes a fully automated\nsetup based on Ansible and provides deep metrics and insights into\nactive Gluster storage pools by using the Grafana platform. Red Hat\nGluster Storage WebAdministration provides a dashboard view which\nallows an administrator to get a view of overall gluster health in\nterms of hosts, volumes, bricks, and other components of GlusterFS.\n\nSecurity Fix(es) :\n\n* django: Catastrophic backtracking in regular expressions via\n'urlize' and 'urlizetrunc' (CVE-2018-7536)\n\n* django: Catastrophic backtracking in regular expressions via\n'truncatechars_html' and 'truncatewords_html' (CVE-2018-7537)\n\n* django: Open redirect possibility in CommonMiddleware\n(CVE-2018-14574)\n\nFor more details about the security issue(s), including the impact, a\nCVSS score, and other related information, refer to the CVE page(s)\nlisted in the References section.\n\nRed Hat would like to thank the Django project for reporting\nCVE-2018-7536 and CVE-2018-7537.\n\nUsers of Red Hat Gluster Storage Web Administration with Red Hat\nGluster Storage are advised to upgrade to this updated package to fix\nthese issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/errata/RHSA-2019:0265\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2018-7536\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2018-7537\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2018-14574\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:tendrl-collectd-selinux\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:tendrl-commons\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:tendrl-node-agent\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:tendrl-selinux\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:7\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2018/03/09\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2019/02/04\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2019/02/06\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Red Hat Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Red Hat\" >!< release) audit(AUDIT_OS_NOT, \"Red Hat\");\nos_ver = pregmatch(pattern: \"Red Hat Enterprise Linux.*release ([0-9]+(\\.[0-9]+)?)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Red Hat\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^7([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Red Hat 7.x\", \"Red Hat \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\" && \"s390\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Red Hat\", cpu);\n\nyum_updateinfo = get_kb_item(\"Host/RedHat/yum-updateinfo\");\nif (!empty_or_null(yum_updateinfo)) \n{\n rhsa = \"RHSA-2019:0265\";\n yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa);\n if (!empty_or_null(yum_report))\n {\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : yum_report \n );\n exit(0);\n }\n else\n {\n audit_message = \"affected by Red Hat security advisory \" + rhsa;\n audit(AUDIT_OS_NOT, audit_message);\n }\n}\nelse\n{\n flag = 0;\n\n if (! (rpm_exists(release:\"RHEL7\", rpm:\"glusterfs-\"))) audit(AUDIT_PACKAGE_NOT_INSTALLED, \"Storage Server\");\n\n if (rpm_check(release:\"RHEL7\", reference:\"tendrl-collectd-selinux-1.5.4-3.el7\")) flag++;\n if (rpm_check(release:\"RHEL7\", reference:\"tendrl-commons-1.6.3-15.el7\")) flag++;\n if (rpm_check(release:\"RHEL7\", reference:\"tendrl-node-agent-1.6.3-15.el7\")) flag++;\n if (rpm_check(release:\"RHEL7\", reference:\"tendrl-selinux-1.5.4-3.el7\")) flag++;\n\n if (flag)\n {\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get() + redhat_report_package_caveat()\n );\n exit(0);\n }\n else\n {\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"tendrl-collectd-selinux / tendrl-commons / tendrl-node-agent / etc\");\n }\n}\n", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}}], "archlinux": [{"lastseen": "2021-07-28T14:34:03", "description": "Arch Linux Security Advisory ASA-201808-3\n=========================================\n\nSeverity: Medium\nDate : 2018-08-03\nCVE-ID : CVE-2018-14574\nPackage : python2-django\nType : open redirect\nRemote : Yes\nLink : https://security.archlinux.org/AVG-746\n\nSummary\n=======\n\nThe package python2-django before version 1.11.15-1 is vulnerable to\nopen redirect.\n\nResolution\n==========\n\nUpgrade to 1.11.15-1.\n\n# pacman -Syu \"python2-django>=1.11.15-1\"\n\nThe problem has been fixed upstream in version 1.11.15.\n\nWorkaround\n==========\n\nDisable the APPEND_SLASH setting.\n\nDescription\n===========\n\nIf the django.middleware.common.CommonMiddleware and the APPEND_SLASH\nsetting are both enabled, and if the project has a URL pattern that\naccepts any path ending in a slash (many content management systems\nhave such a pattern), then a request to a maliciously crafted URL of\nthat site could lead to a redirect to another site, enabling phishing\nand other attacks.\n\nImpact\n======\n\nA remote attacker is able to redirect a user to an attacker-controlled\nwebsite.\n\nReferences\n==========\n\nhttps://www.djangoproject.com/weblog/2018/aug/01/security-releases/\nhttps://github.com/django/django/commit/6fffc3c6d420e44f4029d5643f38d00a39b08525\nhttps://security.archlinux.org/CVE-2018-14574", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "baseScore": 6.1, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "userInteraction": "REQUIRED", "version": "3.0"}, "impactScore": 2.7}, "published": "2018-08-03T00:00:00", "type": "archlinux", "title": "[ASA-201808-3] python2-django: open redirect", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 5.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "acInsufInfo": false, "impactScore": 4.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2018-14574"], "modified": "2018-08-03T00:00:00", "id": "ASA-201808-3", "href": "https://security.archlinux.org/ASA-201808-3", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}}, {"lastseen": "2021-07-28T14:34:03", "description": "Arch Linux Security Advisory ASA-201808-1\n=========================================\n\nSeverity: Medium\nDate : 2018-08-01\nCVE-ID : CVE-2018-14574\nPackage : python-django\nType : open redirect\nRemote : Yes\nLink : https://security.archlinux.org/AVG-743\n\nSummary\n=======\n\nThe package python-django before version 2.0.8-1 is vulnerable to open\nredirect.\n\nResolution\n==========\n\nUpgrade to 2.0.8-1.\n\n# pacman -Syu \"python-django>=2.0.8-1\"\n\nThe problem has been fixed upstream in version 2.0.8.\n\nWorkaround\n==========\n\nDisable the APPEND_SLASH setting.\n\nDescription\n===========\n\nIf the django.middleware.common.CommonMiddleware and the APPEND_SLASH\nsetting are both enabled, and if the project has a URL pattern that\naccepts any path ending in a slash (many content management systems\nhave such a pattern), then a request to a maliciously crafted URL of\nthat site could lead to a redirect to another site, enabling phishing\nand other attacks.\n\nImpact\n======\n\nA remote attacker is able to redirect a user to an attacker-controlled\nwebsite.\n\nReferences\n==========\n\nhttps://www.djangoproject.com/weblog/2018/aug/01/security-releases/\nhttps://github.com/django/django/commit/6fffc3c6d420e44f4029d5643f38d00a39b08525\nhttps://security.archlinux.org/CVE-2018-14574", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "baseScore": 6.1, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "userInteraction": "REQUIRED", "version": "3.0"}, "impactScore": 2.7}, "published": "2018-08-01T00:00:00", "type": "archlinux", "title": "[ASA-201808-1] python-django: open redirect", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 5.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "acInsufInfo": false, "impactScore": 4.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2018-14574"], "modified": "2018-08-01T00:00:00", "id": "ASA-201808-1", "href": "https://security.archlinux.org/ASA-201808-1", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}}], "ubuntu": [{"lastseen": "2022-01-04T11:54:58", "description": "Andreas Hug discovered that Django contained an open redirect in \nCommonMiddleware. A remote attacker could possibly use this issue to \nperform phishing attacks.\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "baseScore": 6.1, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "userInteraction": "REQUIRED", "version": "3.0"}, "impactScore": 2.7}, "published": "2018-08-01T00:00:00", "type": "ubuntu", "title": "Django vulnerability", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 5.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "acInsufInfo": false, "impactScore": 4.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2018-14574"], "modified": "2018-08-01T00:00:00", "id": "USN-3726-1", "href": "https://ubuntu.com/security/notices/USN-3726-1", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}}], "fedora": [{"lastseen": "2021-07-28T14:46:50", "description": "This package provides Django in version 1.11 LTS, the last release to support Python 2. Django is a high-level Python Web framework that encourages rapid development and a clean, pragmatic design. It focuses on automating as much as possible and adhering to the DRY (Don't Repeat Yourself) principle. ", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "baseScore": 6.1, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "userInteraction": "REQUIRED", "version": "3.0"}, "impactScore": 2.7}, "published": "2018-08-14T21:13:31", "type": "fedora", "title": "[SECURITY] Fedora 28 Update: python2-django1.11-1.11.15-2.fc28", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 5.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "acInsufInfo": false, "impactScore": 4.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2018-14574"], "modified": "2018-08-14T21:13:31", "id": "FEDORA:4A6E1631ADA1", "href": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/ETE2RUZVTUH2IUTV4XKRJ2P7ZQYKTSKN/", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}}, {"lastseen": "2021-07-28T14:46:50", "description": "Django is a high-level Python Web framework that encourages rapid development and a clean, pragmatic design. It focuses on automating as much as possible and adhering to the DRY (Don't Repeat Yourself) principle. ", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "baseScore": 6.1, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "userInteraction": "REQUIRED", "version": "3.0"}, "impactScore": 2.7}, "published": "2018-11-03T00:02:47", "type": "fedora", "title": "[SECURITY] Fedora 29 Update: python-django-2.0.9-1.fc29", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 5.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "acInsufInfo": false, "impactScore": 4.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2018-14574"], "modified": "2018-11-03T00:02:47", "id": "FEDORA:431CA61CFCF2", "href": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/HPWXY24APNRSV4TXTNBCYE3DY3UMOY44/", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}}, {"lastseen": "2021-07-28T18:41:38", "description": "This package provides Django in version 1.11 LTS, the last release to support Python 2. Django is a high-level Python Web framework that encourages rapid development and a clean, pragmatic design. It focuses on automating as much as possible and adhering to the DRY (Don't Repeat Yourself) principle. ", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "NONE", "baseScore": 7.5, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "userInteraction": "NONE", "version": "3.0"}, "impactScore": 3.6}, "published": "2019-03-20T21:18:09", "type": "fedora", "title": "[SECURITY] Fedora 28 Update: python2-django1.11-1.11.20-1.fc28", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 5.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "acInsufInfo": false, "impactScore": 4.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2018-14574", "CVE-2019-3498", "CVE-2019-6975"], "modified": "2019-03-20T21:18:09", "id": "FEDORA:DD84F602EC15", "href": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/HVXDOVCXLD74SHR2BENGCE2OOYYYWJHZ/", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}}], "osv": [{"lastseen": "2022-05-12T01:12:07", "description": "django.middleware.common.CommonMiddleware in Django 1.11.x before 1.11.15 and 2.0.x before 2.0.8 has an Open Redirect.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "baseScore": 6.1, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 2.7}, "published": "2018-08-03T17:29:00", "type": "osv", "title": "PYSEC-2018-2", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 5.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 4.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2018-14574"], "modified": "2021-06-10T06:51:09", "id": "OSV:PYSEC-2018-2", "href": "https://osv.dev/vulnerability/PYSEC-2018-2", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}}, {"lastseen": "2022-06-10T04:58:56", "description": "django.middleware.common.CommonMiddleware in Django 1.11.x before 1.11.15 and 2.0.x before 2.0.8 has an Open Redirect.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "baseScore": 6.1, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 2.7}, "published": "2018-10-04T21:58:46", "type": "osv", "title": "Moderate severity vulnerability that affects django", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 5.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 4.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2018-14574"], "modified": "2022-06-10T02:16:23", "id": "OSV:GHSA-5HG3-6C2F-F3WR", "href": "https://osv.dev/vulnerability/GHSA-5hg3-6c2f-f3wr", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}}], "ubuntucve": [{"lastseen": "2021-11-22T21:35:14", "description": "django.middleware.common.CommonMiddleware in Django 1.11.x before 1.11.15\nand 2.0.x before 2.0.8 has an Open Redirect.\n\n#### Notes\n\nAuthor| Note \n---|--- \n[mdeslaur](<https://launchpad.net/~mdeslaur>) | xenial and earlier don't look vulnerable as they will always convert relative redirects to an absolute URI. This was changed by the following commit in later releases: https://github.com/django/django/commit/a0c2eb46dd5a782c11c44f13c8efad2778be1641\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "baseScore": 6.1, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "userInteraction": "REQUIRED", "version": "3.0"}, "impactScore": 2.7}, "published": "2018-08-01T00:00:00", "type": "ubuntucve", "title": "CVE-2018-14574", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 5.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "acInsufInfo": false, "impactScore": 4.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2018-14574"], "modified": "2018-08-01T00:00:00", "id": "UB:CVE-2018-14574", "href": "https://ubuntu.com/security/CVE-2018-14574", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}}], "cve": [{"lastseen": "2022-03-23T13:17:45", "description": "django.middleware.common.CommonMiddleware in Django 1.11.x before 1.11.15 and 2.0.x before 2.0.8 has an Open Redirect.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "baseScore": 6.1, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 2.7}, "published": "2018-08-03T17:29:00", "type": "cve", "title": "CVE-2018-14574", "cwe": ["CWE-601"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 5.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 4.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2018-14574"], "modified": "2019-03-01T19:32:00", "cpe": ["cpe:/o:debian:debian_linux:9.0", "cpe:/o:canonical:ubuntu_linux:18.04"], "id": "CVE-2018-14574", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-14574", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}, "cpe23": ["cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:*:*:*:*", "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"]}], "github": [{"lastseen": "2022-05-13T12:33:32", "description": "django.middleware.common.CommonMiddleware in Django 1.11.x before 1.11.15 and 2.0.x before 2.0.8 has an Open Redirect.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "baseScore": 6.1, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 2.7}, "published": "2018-10-04T21:58:46", "type": "github", "title": "Moderate severity vulnerability that affects django", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 5.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 4.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2018-14574"], "modified": "2021-09-01T22:14:28", "id": "GHSA-5HG3-6C2F-F3WR", "href": "https://github.com/advisories/GHSA-5hg3-6c2f-f3wr", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}}], "redhat": [{"lastseen": "2021-10-19T20:38:59", "description": "Red Hat Gluster Storage Web Administration includes a fully automated setup based on Ansible and provides deep metrics and insights into active Gluster storage pools by using the Grafana platform. Red Hat Gluster Storage WebAdministration provides a dashboard view which allows an administrator to get a view of overall gluster health in terms of hosts, volumes, bricks, and other components of GlusterFS.\n\nSecurity Fix(es):\n\n* django: Catastrophic backtracking in regular expressions via 'urlize' and 'urlizetrunc' (CVE-2018-7536)\n\n* django: Catastrophic backtracking in regular expressions via 'truncatechars_html' and 'truncatewords_html' (CVE-2018-7537)\n\n* django: Open redirect possibility in CommonMiddleware (CVE-2018-14574)\n\nFor more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.\n\nRed Hat would like to thank the Django project for reporting CVE-2018-7536 and CVE-2018-7537.\n\nUsers of Red Hat Gluster Storage Web Administration with Red Hat Gluster Storage are advised to upgrade to this updated package to fix these issues.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "baseScore": 6.1, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "userInteraction": "REQUIRED", "version": "3.0"}, "impactScore": 2.7}, "published": "2019-02-04T07:32:25", "type": "redhat", "title": "(RHSA-2019:0265) Moderate: Red Hat Gluster Storage Web Administration security update", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 5.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "acInsufInfo": false, "impactScore": 4.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2018-14574", "CVE-2018-7536", "CVE-2018-7537"], "modified": "2019-02-04T07:33:35", "id": "RHSA-2019:0265", "href": "https://access.redhat.com/errata/RHSA-2019:0265", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}}]}