Python Library Django 4.2.x < 4.2.29 / 5.2.x < 5.2.12 / 6.0.x < 6.0.3 DoS

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(300915);
  script_version("1.4");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/04/30");

  script_cve_id("CVE-2026-25673");
  script_xref(name:"IAVA", value:"2026-A-0199-S");

  script_name(english:"Python Library Django 4.2.x < 4.2.29 / 5.2.x < 5.2.12 / 6.0.x < 6.0.3 DoS");

  script_set_attribute(attribute:"synopsis", value:
"A Python library installed on the remote host is affected by a denial of service vulnerability.");
  script_set_attribute(attribute:"description", value:
"The detected version of the Django Python package, is 4.2.x prior to 4.2.29, 5.2.x prior to 5.2.12, or 6.0.x
prior to 6.0.3. It is, therefore, affected by a denial of service vulnerability as referenced by security release advisory:

  - An issue was discovered in 6.0 before 6.0.3, 5.2 before 5.2.12, and 4.2 before 4.2.29. 
    `URLField.to_python()` in Django calls `urllib.parse.urlsplit()`, which performs NFKC normalization on 
    Windows that is disproportionately slow for certain Unicode characters, allowing a remote attacker to 
    cause denial of service via large URL inputs containing these characters. Earlier, unsupported Django 
    series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. (CVE-2026-25673)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://www.djangoproject.com/weblog/2026/mar/03/security-releases/");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Django version 4.2.29, 5.2.12, 6.0.3 or later.");
  script_set_attribute(attribute:"agent", value:"windows");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-25673");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/03/03");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/03/03");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/03/05");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"asset_categories", value:"component");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:djangoproject:django");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Windows");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("python_packages_win_installed.nbin");
  script_require_ports("Host/win/Python/Packages/Enumerated", "SMB/Registry/Enumerated");

  exit(0);
}

include('python.inc');

var pkg = 'Django';

var libs = python::get_package_info(pkg_name:pkg, cpe:"cpe:/a:djangoproject:django");

if (empty_or_null(libs))
  audit(AUDIT_NOT_INST, pkg);

vcf::check_all_backporting(app_info:libs);

var constraints = [
  { 'min_version' : '4.2' , 'fixed_version' : '4.2.29' },
  { 'min_version' : '5.2' , 'fixed_version' : '5.2.12' },
  { 'min_version' : '6.0' , 'fixed_version' : '6.0.3' }
];

vcf::check_version_and_report(
  app_info:libs,
  constraints:constraints,
  severity:SECURITY_HOLE
);