Fedora 43 : python-django-haystack (2026-1d2c7eaa2f)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##
# The descriptive text and package checks in this plugin were
# extracted from Fedora Security Advisory FEDORA-2026-1d2c7eaa2f
#

include('compat.inc');

if (description)
{
  script_id(323996);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/07/01");
  script_xref(name:"FEDORA", value:"2026-1d2c7eaa2f");

  script_name(english:"Fedora 43 : python-django-haystack (2026-1d2c7eaa2f)");

  script_set_attribute(attribute:"synopsis", value:
"The remote Fedora host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the
FEDORA-2026-1d2c7eaa2f advisory.

    Fixes GHSA-r3hx-x5rh-p9vv: via `eval()` in Elasticsearch Result Deserialization

    https://github.com/django-haystack/django-haystack/security/advisories/GHSA-r3hx-x5rh-p9vv

    ## What's Changed
    https://github.com/django-haystack/django-haystack/releases/tag/v3.4.0

    * Remove obsolete ElasticSearch2 support and tests by @claudep in https://github.com/django-
    haystack/django-haystack/pull/1978
    * Add Django v5.1 to the testing by @cclauss in https://github.com/django-haystack/django-
    haystack/pull/1991
    * GitHub Actions: Add Python 3.13 to the testing by @cclauss in https://github.com/django-haystack/django-
    haystack/pull/1997
    * Fix typo. by @andresmrm in https://github.com/django-haystack/django-haystack/pull/1998
    * Fix RelatedSearchQueryset.load_all() truncating results by @craigds in https://github.com/django-
    haystack/django-haystack/pull/2012
    * [FIXED] -- handle trailing slash in Solr index URL for core reload. by @DhavalGojiya in
    https://github.com/django-haystack/django-haystack/pull/1968
    * Bump the github-actions group with 2 updates by @dependabot[bot] in https://github.com/django-
    haystack/django-haystack/pull/2018
    * Update license field to use proper SPDX identifier by @leifdreizler in https://github.com/django-
    haystack/django-haystack/pull/2016
    * dev: Update Python dependencies by @kingbuzzman in https://github.com/django-haystack/django-
    haystack/pull/2019
    * dev: Update django by @kingbuzzman in https://github.com/django-haystack/django-haystack/pull/2020
    * fix: handle HEAD requests like GET in generic_views by @janheini in https://github.com/django-
    haystack/django-haystack/pull/2015
    * feat: Add requires-python to pyproject.toml (PEP 621) by @DhavalGojiya in https://github.com/django-
    haystack/django-haystack/pull/2039
    * Add Python 3.14 and 3.14t to the testing by @cclauss in https://github.com/django-haystack/django-
    haystack/pull/2031
    * Fix race condition in ConnectionRouter.routers lazy initialization by @craigds in
    https://github.com/django-haystack/django-haystack/pull/2048
    * add postgres backend to backend_support.rst by @fgregg in https://github.com/django-haystack/django-
    haystack/pull/2044
    * Actions: limit permissions for tests by @acdha in https://github.com/django-haystack/django-
    haystack/pull/2053
    * GitHub Actions: zizmor fixes by @acdha in https://github.com/django-haystack/django-haystack/pull/2055


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://bodhi.fedoraproject.org/updates/FEDORA-2026-1d2c7eaa2f");
  script_set_attribute(attribute:"solution", value:
"Update the affected python-django-haystack package.");
  script_set_attribute(attribute:"risk_factor", value:"High");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/06/22");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/06/22");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/07/01");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:fedoraproject:fedora:43");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:python-django-haystack");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Fedora Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list");

  exit(0);
}


include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'Fedora' >!< os_product) audit(AUDIT_OS_NOT, 'Fedora');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'Fedora');
if (! preg(pattern:"^43([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'Fedora 43', 'Fedora ' + os_version);

if (!get_kb_item('Host/RedHat/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Fedora', cpu);

var constraints = [
  {
    'release': '43',
    'pkgs': [
      {'reference':'python-django-haystack-3.4.0-1.fc43', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}

if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'python-django-haystack');
}