Test ID:	1.3.6.1.4.1.25623.1.0.892676
Category:	Debian Local Security Checks
Title:	Debian: Security Advisory (DLA-2676-1)
Summary:	The remote host is missing an update for the Debian 'python-django' package(s) announced via the DLA-2676-1 advisory.
Description:	Summary: The remote host is missing an update for the Debian 'python-django' package(s) announced via the DLA-2676-1 advisory. Vulnerability Insight: Two issues were discovered in Django, the Python-based web development framework: CVE-2021-33203 Potential directory traversal via admindocs Staff members could use the admindocs TemplateDetailView view to check the existence of arbitrary files. Additionally, if (and only if) the default admindocs templates have been customized by the developers to also expose the file contents, then not only the existence but also the file contents would have been exposed. As a mitigation, path sanitation is now applied and only files within the template root directories can be loaded. This issue has low severity, according to the Django security policy. Thanks to Rasmus Lerchedahl Petersen and Rasmus Wriedt Larsen from the CodeQL Python team for the report. CVE-2021-33571 Possible indeterminate SSRF, RFI, and LFI attacks since validators accepted leading zeros in IPv4 addresses URLValidator, validate_ipv4_address(), and validate_ipv46_address() didn't prohibit leading zeros in octal literals. If you used such values you could suffer from indeterminate SSRF, RFI, and LFI attacks. validate_ipv4_address() and validate_ipv46_address() validators were not affected on Python 3.9.5+. This issue has medium severity, according to the Django security policy. For Debian 9 Stretch, these problems have been fixed in version 1:1.10.7-2+deb9u14. We recommend that you upgrade your python-django packages. Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: [link moved to references] Affected Software/OS: 'python-django' package(s) on Debian 9. Solution: Please install the updated package(s). CVSS Score: 5.0 CVSS Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2021-33203 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/B4SQG2EAF4WCI2SLRL6XRDJ3RPK3ZRDV/ https://docs.djangoproject.com/en/3.2/releases/security/ https://groups.google.com/forum/#!forum/django-announce Common Vulnerability Exposure (CVE) ID: CVE-2021-33571 https://groups.google.com/g/django-announce/c/sPyjSKMi8Eo v2.2.24 https://github.com/django/django/commit/f27c38ab5d90f68c9dd60cabef248a570c0be8fc v3.1.12 https://github.com/django/django/commit/203d4ab9ebcd72fc4d6eb7398e66ed9e474e118e v3.2.4 https://github.com/django/django/commit/9f75e2e562fa0c0482f3dde6fc7399a9070b4a3d
Copyright	Copyright (C) 2021 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.