Vulnerabilities > CVE-2017-7233 - Open Redirect vulnerability in Djangoproject Django

CVSS 6.1 - MEDIUM

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

LOW

Integrity impact

LOW

Availability impact

NONE

network

low complexity

djangoproject

CWE-601

nessus

NVD

Published: 2017-04-04

Updated: 2018-10-17

Summary

Django 1.10 before 1.10.7, 1.9 before 1.9.13, and 1.8 before 1.8.18 relies on user input in some cases to redirect the user to an "on success" URL. The security check for these redirects (namely ``django.utils.http.is_safe_url()``) considered some numeric URLs "safe" when they shouldn't be, aka an open redirect vulnerability. Also, if a developer relies on ``is_safe_url()`` to provide safe redirect targets and puts such a URL into a link, they could suffer from an XSS attack.

Vulnerable Configurations

Part	Description	Count
Application	Djangoproject Djangoproject Django 1.10.0 Djangoproject Django 1.9 Djangoproject Django 1.8.0 Djangoproject Django 1.8.15 Djangoproject Django 1.8.2 Djangoproject Django 1.9.6 Djangoproject Django 1.10.3 Djangoproject Django 1.8.14 Djangoproject Django 1.9.9 Djangoproject Django 1.8.1 Djangoproject Django 1.10.1 Djangoproject Django 1.8.7 Djangoproject Django 1.8.9 Djangoproject Django 1.10.5 Djangoproject Django 1.9.5 Djangoproject Django 1.8.11 Djangoproject Django 1.9.12 Djangoproject Django 1.8.3 Djangoproject Django 1.8.12 Djangoproject Django 1.8.4 Djangoproject Django 1.9.11 Djangoproject Django 1.10.2 Djangoproject Django 1.8.16 Djangoproject Django 1.9.3 Djangoproject Django 1.9.4 Djangoproject Django 1.8.6 Djangoproject Django 1.10.6 Djangoproject Django 1.8.13 Djangoproject Django 1.9.7 Djangoproject Django 1.8.17 Djangoproject Django 1.8.8 Djangoproject Django 1.8.5 Djangoproject Django 1.9.1 Djangoproject Django 1.10.4 Djangoproject Django 1.9.8 Djangoproject Django 1.9.2 Djangoproject Django 1.9.10 Djangoproject Django 1.8.10	49

Common Weakness Enumeration (CWE)

CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')

Common Attack Pattern Enumeration and Classification (CAPEC)

Fake the Source of Data
An adversary provides data under a falsified identity. The purpose of using the falsified identity may be to prevent traceability of the provided data or it might be an attempt by the adversary to assume the rights granted to another identity. One of the simplest forms of this attack would be the creation of an email message with a modified "From" field in order to appear that the message was sent from someone other than the actual sender. Results of the attack vary depending on the details of the attack, but common results include privilege escalation, obfuscation of other attacks, and data corruption/manipulation.

Nessus

NASL family	Red Hat Local Security Checks
NASL id	REDHAT-RHSA-2018-2927.NASL
description	An update is now available for Red Hat Satellite 6.4 for RHEL 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Red Hat Satellite is a systems management tool for Linux-based infrastructure. It allows for provisioning, remote management, and monitoring of multiple Linux deployments with a single centralized tool. Security Fix(es) : * jackson-databind: Unsafe deserialization due to incomplete black list (incomplete fix for CVE-2017-7525) (CVE-2017-15095) * hornetq: XXE/SSRF in XPath selector (CVE-2015-3208) * bouncycastle: Information disclosure in GCMBlockCipher (CVE-2015-6644) * bouncycastle: DSA does not fully validate ASN.1 encoding during signature verification allowing for injection of unsigned data (CVE-2016-1000338) * bouncycastle: Information leak in AESFastEngine class (CVE-2016-1000339) * bouncycastle: Information exposure in DSA signature generation via timing attack (CVE-2016-1000341) * bouncycastle: ECDSA improper validation of ASN.1 encoding of signature (CVE-2016-1000342) * bouncycastle: DHIES implementation allowed the use of ECB mode (CVE-2016-1000344) * bouncycastle: DHIES/ECIES CBC modes are vulnerable to padding oracle attack (CVE-2016-1000345) * bouncycastle: Other party DH public keys are not fully validated (CVE-2016-1000346) * bouncycastle: ECIES implementation allowed the use of ECB mode (CVE-2016-1000352) * logback: Serialization vulnerability in SocketServer and ServerSocketReceiver (CVE-2017-5929) * python-django: Open redirect and possible XSS attack via user-supplied numeric redirect URLs (CVE-2017-7233) * hibernate-validator: Privilege escalation when running under the security manager (CVE-2017-7536) * puppet: Environment leakage in puppet-agent (CVE-2017-10690) * Satellite 6: XSS in discovery rule filter autocomplete functionality (CVE-2017-12175) * foreman: Stored XSS in fact name or value (CVE-2017-15100) * pulp: sensitive credentials revealed through the API (CVE-2018-1090) * foreman: SQL injection due to improper handling of the widget id parameter (CVE-2018-1096) * foreman: Ovirt admin password exposed by foreman API (CVE-2018-1097) * django: Catastrophic backtracking in regular expressions via
last seen	2020-06-01
modified	2020-06-02
plugin id	118185
published	2018-10-18
reporter	This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/118185
title	RHEL 7 : Satellite Server (RHSA-2018:2927)
code	# # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from Red Hat Security Advisory RHSA-2018:2927. The text # itself is copyright (C) Red Hat, Inc. # include("compat.inc"); if (description) { script_id(118185); script_version("1.7"); script_cvs_date("Date: 2019/10/24 15:35:45"); script_cve_id("CVE-2015-3208", "CVE-2015-6644", "CVE-2016-1000338", "CVE-2016-1000339", "CVE-2016-1000340", "CVE-2016-1000341", "CVE-2016-1000342", "CVE-2016-1000343", "CVE-2016-1000344", "CVE-2016-1000345", "CVE-2016-1000346", "CVE-2016-1000352", "CVE-2017-10689", "CVE-2017-10690", "CVE-2017-12175", "CVE-2017-15095", "CVE-2017-15100", "CVE-2017-5929", "CVE-2017-7233", "CVE-2017-7536", "CVE-2018-10237", "CVE-2018-1090", "CVE-2018-1096", "CVE-2018-1097", "CVE-2018-5382", "CVE-2018-7536", "CVE-2018-7537"); script_xref(name:"RHSA", value:"2018:2927"); script_name(english:"RHEL 7 : Satellite Server (RHSA-2018:2927)"); script_summary(english:"Checks the rpm output for the updated packages"); script_set_attribute( attribute:"synopsis", value:"The remote Red Hat host is missing one or more security updates." ); script_set_attribute( attribute:"description", value: "An update is now available for Red Hat Satellite 6.4 for RHEL 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Red Hat Satellite is a systems management tool for Linux-based infrastructure. It allows for provisioning, remote management, and monitoring of multiple Linux deployments with a single centralized tool. Security Fix(es) : * jackson-databind: Unsafe deserialization due to incomplete black list (incomplete fix for CVE-2017-7525) (CVE-2017-15095) * hornetq: XXE/SSRF in XPath selector (CVE-2015-3208) * bouncycastle: Information disclosure in GCMBlockCipher (CVE-2015-6644) * bouncycastle: DSA does not fully validate ASN.1 encoding during signature verification allowing for injection of unsigned data (CVE-2016-1000338) * bouncycastle: Information leak in AESFastEngine class (CVE-2016-1000339) * bouncycastle: Information exposure in DSA signature generation via timing attack (CVE-2016-1000341) * bouncycastle: ECDSA improper validation of ASN.1 encoding of signature (CVE-2016-1000342) * bouncycastle: DHIES implementation allowed the use of ECB mode (CVE-2016-1000344) * bouncycastle: DHIES/ECIES CBC modes are vulnerable to padding oracle attack (CVE-2016-1000345) * bouncycastle: Other party DH public keys are not fully validated (CVE-2016-1000346) * bouncycastle: ECIES implementation allowed the use of ECB mode (CVE-2016-1000352) * logback: Serialization vulnerability in SocketServer and ServerSocketReceiver (CVE-2017-5929) * python-django: Open redirect and possible XSS attack via user-supplied numeric redirect URLs (CVE-2017-7233) * hibernate-validator: Privilege escalation when running under the security manager (CVE-2017-7536) * puppet: Environment leakage in puppet-agent (CVE-2017-10690) * Satellite 6: XSS in discovery rule filter autocomplete functionality (CVE-2017-12175) * foreman: Stored XSS in fact name or value (CVE-2017-15100) * pulp: sensitive credentials revealed through the API (CVE-2018-1090) * foreman: SQL injection due to improper handling of the widget id parameter (CVE-2018-1096) * foreman: Ovirt admin password exposed by foreman API (CVE-2018-1097) * django: Catastrophic backtracking in regular expressions via 'urlize' and 'urlizetrunc' (CVE-2018-7536) * django: Catastrophic backtracking in regular expressions via 'truncatechars_html' and 'truncatewords_html' (CVE-2018-7537) * guava: Unbounded memory allocation in AtomicDoubleArray and CompoundOrdering classes allow remote attackers to cause a denial of service (CVE-2018-10237) * bouncycastle: Carry propagation bug in math.raw.Nat??? class (CVE-2016-1000340) * bouncycastle: DSA key pair generator generates a weak private key by default (CVE-2016-1000343) * puppet: Unpacking of tarballs in tar/mini.rb can create files with insecure permissions (CVE-2017-10689) * bouncycastle: BKS-V1 keystore files vulnerable to trivial hash collisions (CVE-2018-5382) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section. Red Hat would like to thank Liao Xinxi (NSFOCUS) for reporting CVE-2017-15095; and the Django project for reporting CVE-2017-7233, CVE-2018-7536, and CVE-2018-7537. The CVE-2017-7536 issue was discovered by Gunnar Morling (Red Hat); and the CVE-2018-1096 issue was discovered by Martin Povolny (Red Hat). Red Hat would also like to thank David Jorm (IIX Product Security) for reporting CVE-2015-3208. Additional Changes : This update also fixes several bugs and adds various enhancements. Documentation for these changes is available from the Release Notes document linked to in the References section." ); # https://access.redhat.com/documentation/en-us/red_hat_satellite/6.4/html/ script_set_attribute( attribute:"see_also", value:"http://www.nessus.org/u?68e28b4d" ); script_set_attribute( attribute:"see_also", value:"https://access.redhat.com/errata/RHSA-2018:2927" ); script_set_attribute( attribute:"see_also", value:"https://access.redhat.com/security/cve/cve-2015-3208" ); script_set_attribute( attribute:"see_also", value:"https://access.redhat.com/security/cve/cve-2015-6644" ); script_set_attribute( attribute:"see_also", value:"https://access.redhat.com/security/cve/cve-2016-1000338" ); script_set_attribute( attribute:"see_also", value:"https://access.redhat.com/security/cve/cve-2016-1000339" ); script_set_attribute( attribute:"see_also", value:"https://access.redhat.com/security/cve/cve-2016-1000340" ); script_set_attribute( attribute:"see_also", value:"https://access.redhat.com/security/cve/cve-2016-1000341" ); script_set_attribute( attribute:"see_also", value:"https://access.redhat.com/security/cve/cve-2016-1000342" ); script_set_attribute( attribute:"see_also", value:"https://access.redhat.com/security/cve/cve-2016-1000343" ); script_set_attribute( attribute:"see_also", value:"https://access.redhat.com/security/cve/cve-2016-1000344" ); script_set_attribute( attribute:"see_also", value:"https://access.redhat.com/security/cve/cve-2016-1000345" ); script_set_attribute( attribute:"see_also", value:"https://access.redhat.com/security/cve/cve-2016-1000346" ); script_set_attribute( attribute:"see_also", value:"https://access.redhat.com/security/cve/cve-2016-1000352" ); script_set_attribute( attribute:"see_also", value:"https://access.redhat.com/security/cve/cve-2017-5929" ); script_set_attribute( attribute:"see_also", value:"https://access.redhat.com/security/cve/cve-2017-7233" ); script_set_attribute( attribute:"see_also", value:"https://access.redhat.com/security/cve/cve-2017-7536" ); script_set_attribute( attribute:"see_also", value:"https://access.redhat.com/security/cve/cve-2017-10689" ); script_set_attribute( attribute:"see_also", value:"https://access.redhat.com/security/cve/cve-2017-10690" ); script_set_attribute( attribute:"see_also", value:"https://access.redhat.com/security/cve/cve-2017-12175" ); script_set_attribute( attribute:"see_also", value:"https://access.redhat.com/security/cve/cve-2017-15095" ); script_set_attribute( attribute:"see_also", value:"https://access.redhat.com/security/cve/cve-2017-15100" ); script_set_attribute( attribute:"see_also", value:"https://access.redhat.com/security/cve/cve-2018-1090" ); script_set_attribute( attribute:"see_also", value:"https://access.redhat.com/security/cve/cve-2018-1096" ); script_set_attribute( attribute:"see_also", value:"https://access.redhat.com/security/cve/cve-2018-1097" ); script_set_attribute( attribute:"see_also", value:"https://access.redhat.com/security/cve/cve-2018-5382" ); script_set_attribute( attribute:"see_also", value:"https://access.redhat.com/security/cve/cve-2018-7536" ); script_set_attribute( attribute:"see_also", value:"https://access.redhat.com/security/cve/cve-2018-7537" ); script_set_attribute( attribute:"see_also", value:"https://access.redhat.com/security/cve/cve-2018-10237" ); script_set_attribute(attribute:"solution", value:"Update the affected packages."); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P"); script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:SOAPpy"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:ansiblerole-insights-client"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:candlepin"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:candlepin-selinux"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:createrepo_c"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:createrepo_c-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:createrepo_c-libs"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:foreman"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:foreman-bootloaders-redhat"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:foreman-bootloaders-redhat-tftpboot"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:foreman-cli"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:foreman-compute"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:foreman-debug"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:foreman-ec2"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:foreman-gce"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:foreman-installer"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:foreman-installer-katello"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:foreman-journald"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:foreman-libvirt"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:foreman-openstack"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:foreman-ovirt"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:foreman-postgresql"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:foreman-proxy"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:foreman-proxy-content"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:foreman-rackspace"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:foreman-selinux"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:foreman-telemetry"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:foreman-vmware"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:hfsplus-tools"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:hfsplus-tools-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:katello"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:katello-certs-tools"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:katello-client-bootstrap"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:katello-common"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:katello-debug"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:katello-installer-base"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:katello-selinux"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:katello-service"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:kobo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:libwebsockets"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:libwebsockets-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:liquibase"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:livecd-tools"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:mod_passenger"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:mod_xsendfile"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:mod_xsendfile-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:ostree"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:ostree-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:pcp-mmvstatsd"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:pulp-admin-client"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:pulp-docker-admin-extensions"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:pulp-docker-plugins"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:pulp-katello"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:pulp-maintenance"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:pulp-ostree-admin-extensions"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:pulp-ostree-plugins"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:pulp-puppet-admin-extensions"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:pulp-puppet-plugins"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:pulp-puppet-tools"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:pulp-rpm-admin-extensions"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:pulp-rpm-plugins"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:pulp-selinux"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:pulp-server"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:puppet-agent"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:puppet-agent-oauth"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:puppet-foreman_scap_client"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:puppetlabs-stdlib"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:puppetserver"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:python-billiard-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:python-blinker"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:python-bson"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:python-crane"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:python-flask"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:python-fpconst"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:python-gnupg"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:python-gofer"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:python-gofer-qpid"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:python-imgcreate"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:python-isodate"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:python-itsdangerous"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:python-jinja2"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:python-kid"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:python-mongoengine"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:python-nectar"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:python-oauth2"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:python-okaara"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:python-pulp-bindings"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:python-pulp-client-lib"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:python-pulp-common"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:python-pulp-docker-common"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:python-pulp-integrity"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:python-pulp-oid_validation"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:python-pulp-ostree-common"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:python-pulp-puppet-common"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:python-pulp-repoauth"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:python-pulp-rpm-common"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:python-pulp-streamer"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:python-pymongo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:python-pymongo-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:python-pymongo-gridfs"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:python-qpid"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:python-qpid-proton"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:python-qpid-qmf"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:python-saslwrapper"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:python-semantic_version"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:python-simplejson"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:python-simplejson-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:python-twisted-core"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:python-twisted-core-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:python-twisted-web"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:python-werkzeug"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:python-zope-interface"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:python-zope-interface-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:python2-amqp"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:python2-billiard"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:python2-celery"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:python2-django"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:python2-kombu"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:python2-vine"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:qpid-cpp-client"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:qpid-cpp-client-devel"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:qpid-cpp-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:qpid-cpp-server"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:qpid-cpp-server-linearstore"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:qpid-dispatch-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:qpid-dispatch-router"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:qpid-dispatch-tools"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:qpid-proton-c"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:qpid-proton-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:qpid-qmf"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:qpid-tools"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:redhat-access-insights-puppet"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:repoview"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:rubygem-ansi"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:rubygem-bundler_ext"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:rubygem-clamp"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:rubygem-concurrent-ruby"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:rubygem-facter"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:rubygem-fast_gettext"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:rubygem-ffi"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:rubygem-ffi-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:rubygem-foreman_scap_client"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:rubygem-gssapi"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:rubygem-hashie"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:rubygem-highline"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:rubygem-kafo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:rubygem-kafo_parsers"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:rubygem-kafo_wizards"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:rubygem-little-plugger"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:rubygem-logging"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:rubygem-mime-types"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:rubygem-multi_json"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:rubygem-netrc"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:rubygem-newt"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:rubygem-newt-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:rubygem-oauth"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:rubygem-openscap"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:rubygem-passenger"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:rubygem-passenger-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:rubygem-passenger-native"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:rubygem-passenger-native-libs"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:rubygem-powerbar"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:rubygem-rake"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:rubygem-rb-inotify"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:rubygem-rest-client"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:rubygem-rkerberos"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:rubygem-rkerberos-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:rubygem-rsec"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:rubygem-rubyipmi"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:rubygem-smart_proxy_ansible"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:rubygem-smart_proxy_dhcp_remote_isc"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:rubygem-smart_proxy_discovery"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:rubygem-smart_proxy_discovery_image"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:rubygem-smart_proxy_dynflow"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:rubygem-smart_proxy_openscap"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:rubygem-smart_proxy_pulp"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:rubygem-smart_proxy_remote_execution_ssh"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:rubygem-tilt"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:saslwrapper"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:saslwrapper-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:satellite"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:satellite-capsule"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:satellite-cli"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:satellite-common"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:satellite-debug-tools"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:satellite-installer"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-ror51-rubygem-actioncable"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-ror51-rubygem-actionmailer"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-ror51-rubygem-actionpack"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-ror51-rubygem-actionview"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-ror51-rubygem-activejob"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-ror51-rubygem-activemodel"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-ror51-rubygem-activerecord"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-ror51-rubygem-activesupport"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-ror51-rubygem-arel"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-ror51-rubygem-builder"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-ror51-rubygem-coffee-rails"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-ror51-rubygem-coffee-script"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-ror51-rubygem-coffee-script-source"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-ror51-rubygem-concurrent-ruby"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-ror51-rubygem-crass"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-ror51-rubygem-erubi"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-ror51-rubygem-execjs"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-ror51-rubygem-globalid"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-ror51-rubygem-i18n"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-ror51-rubygem-loofah"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-ror51-rubygem-mail"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-ror51-rubygem-method_source"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-ror51-rubygem-mime-types"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-ror51-rubygem-mime-types-data"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-ror51-rubygem-mini_mime"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-ror51-rubygem-multi_json"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-ror51-rubygem-mustermann"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-ror51-rubygem-nio4r"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-ror51-rubygem-nio4r-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-ror51-rubygem-nokogiri"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-ror51-rubygem-nokogiri-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-ror51-rubygem-rack"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-ror51-rubygem-rack-protection"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-ror51-rubygem-rack-test"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-ror51-rubygem-rails"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-ror51-rubygem-rails-dom-testing"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-ror51-rubygem-rails-html-sanitizer"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-ror51-rubygem-railties"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-ror51-rubygem-sinatra"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-ror51-rubygem-sprockets"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-ror51-rubygem-sprockets-rails"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-ror51-rubygem-sqlite3"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-ror51-rubygem-sqlite3-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-ror51-rubygem-thor"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-ror51-rubygem-thread_safe"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-ror51-rubygem-tilt"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-ror51-rubygem-turbolinks"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-ror51-rubygem-tzinfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-ror51-rubygem-websocket-driver"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-ror51-rubygem-websocket-driver-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-ror51-rubygem-websocket-extensions"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-ror51-runtime"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-activerecord-session_store"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-addressable"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-algebrick"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-ancestry"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-anemone"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-angular-rails-templates"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-apipie-bindings"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-apipie-params"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-apipie-rails"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-audited"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-autoparse"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-awesome_print"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-bastion"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-bundler_ext"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-clamp"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-concurrent-ruby-edge"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-css_parser"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-daemons"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-deacon"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-deep_cloneable"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-deface"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-diffy"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-docker-api"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-domain_name"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-dynflow"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-excon"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-extlib"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-facter"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-faraday"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-fast_gettext"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-ffi"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-ffi-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-fog"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-fog-aws"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-fog-core"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-fog-digitalocean"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-fog-google"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-fog-json"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-fog-libvirt"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-fog-openstack"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-fog-ovirt"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-fog-rackspace"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-fog-vsphere"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-fog-xenserver"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-fog-xml"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-foreman-redhat_access"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-foreman-tasks"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-foreman-tasks-core"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-foreman_ansible"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-foreman_ansible_core"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-foreman_bootdisk"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-foreman_discovery"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-foreman_docker"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-foreman_hooks"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-foreman_openscap"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-foreman_remote_execution"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-foreman_remote_execution_core"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-foreman_templates"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-foreman_theme_satellite"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-foreman_virt_who_configure"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-formatador"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-friendly_id"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-get_process_mem"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-gettext_i18n_rails"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-git"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-google-api-client"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-gssapi"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-hammer_cli"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-hammer_cli_csv"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-hammer_cli_foreman"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-hammer_cli_foreman_admin"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-hammer_cli_foreman_ansible"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-hammer_cli_foreman_bootdisk"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-hammer_cli_foreman_discovery"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-hammer_cli_foreman_docker"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-hammer_cli_foreman_openscap"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-hammer_cli_foreman_remote_execution"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-hammer_cli_foreman_tasks"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-hammer_cli_foreman_templates"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-hammer_cli_foreman_virt_who_configure"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-hammer_cli_katello"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-hashie"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-highline"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-http-cookie"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-ipaddress"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-jgrep"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-journald-logger"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-journald-native"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-journald-native-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-jwt"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-katello"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-launchy"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-ldap_fluff"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-little-plugger"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-locale"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-logging"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-logging-journald"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-multipart-post"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-net-ldap"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-net-ping"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-net-scp"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-net-ssh"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-net-ssh-krb"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-netrc"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-oauth"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-ovirt-engine-sdk"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-ovirt-engine-sdk-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-ovirt_provision_plugin"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-parse-cron"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-passenger"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-passenger-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-passenger-native"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-passenger-native-libs"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-pg"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-pg-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-polyglot"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-powerbar"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-prometheus-client"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-qpid_messaging"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-qpid_messaging-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-quantile"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-rabl"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-rack-jsonp"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-rails-i18n"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-rainbow"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-rbovirt"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-rbvmomi"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-record_tag_helper"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-redhat_access"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-redhat_access_lib"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-responders"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-rest-client"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-retriable"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-roadie"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-roadie-rails"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-robotex"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-ruby-libvirt"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-ruby-libvirt-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-ruby2ruby"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-ruby_parser"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-runcible"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-safemode"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-scoped_search"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-secure_headers"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-sequel"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-sexp_processor"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-signet"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-smart_proxy_dynflow_core"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-sshkey"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-statsd-instrument"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-trollop"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-unf"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-unf_ext"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-unf_ext-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-unicode"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-unicode-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-unicode-display_width"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-useragent"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-validates_lengths_from_database"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-webpack-rails"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-wicked"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-will_paginate"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-x-editable-rails"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tfm-runtime"); script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:7"); script_set_attribute(attribute:"vuln_publication_date", value:"2016/01/06"); script_set_attribute(attribute:"patch_publication_date", value:"2018/10/16"); script_set_attribute(attribute:"plugin_publication_date", value:"2018/10/18"); script_set_attribute(attribute:"generated_plugin", value:"current"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"Red Hat Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list", "Host/cpu"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("misc_func.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/RedHat/release"); if (isnull(release) \|\| "Red Hat" >!< release) audit(AUDIT_OS_NOT, "Red Hat"); os_ver = pregmatch(pattern: "Red Hat Enterprise Linux.*release ([0-9]+(\.[0-9]+)?)", string:release); if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Red Hat"); os_ver = os_ver[1]; if (! preg(pattern:"^7([^0-9]\|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Red Hat 7.x", "Red Hat " + os_ver); if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); cpu = get_kb_item("Host/cpu"); if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH); if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "s390" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Red Hat", cpu); yum_updateinfo = get_kb_item("Host/RedHat/yum-updateinfo"); if (!empty_or_null(yum_updateinfo)) { rhsa = "RHSA-2018:2927"; yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa); if (!empty_or_null(yum_report)) { security_report_v4( port : 0, severity : SECURITY_HOLE, extra : yum_report ); exit(0); } else { audit_message = "affected by Red Hat security advisory " + rhsa; audit(AUDIT_OS_NOT, audit_message); } } else { flag = 0; if (! (rpm_exists(release:"RHEL7", rpm:"katello-agent-3.3"))) audit(AUDIT_PACKAGE_NOT_INSTALLED, "Satellite Server"); if (rpm_check(release:"RHEL7", reference:"SOAPpy-0.11.6-17.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"ansiblerole-insights-client-1.5-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"candlepin-2.4.8-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"candlepin-selinux-2.4.8-1.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"createrepo_c-0.7.4-1.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"createrepo_c-debuginfo-0.7.4-1.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"createrepo_c-libs-0.7.4-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"foreman-1.18.0.37-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"foreman-bootloaders-redhat-201801241201-3.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"foreman-bootloaders-redhat-tftpboot-201801241201-3.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"foreman-cli-1.18.0.37-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"foreman-compute-1.18.0.37-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"foreman-debug-1.18.0.37-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"foreman-ec2-1.18.0.37-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"foreman-gce-1.18.0.37-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"foreman-installer-1.18.0.2-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"foreman-installer-katello-3.7.0.10-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"foreman-journald-1.18.0.37-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"foreman-libvirt-1.18.0.37-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"foreman-openstack-1.18.0.37-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"foreman-ovirt-1.18.0.37-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"foreman-postgresql-1.18.0.37-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"foreman-proxy-1.18.0.1-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"foreman-proxy-content-3.7.0-8.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"foreman-rackspace-1.18.0.37-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"foreman-selinux-1.18.0.1-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"foreman-telemetry-1.18.0.37-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"foreman-vmware-1.18.0.37-1.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"hfsplus-tools-332.14-12.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"hfsplus-tools-debuginfo-332.14-12.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"katello-3.7.0-8.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"katello-certs-tools-2.4.0-2.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"katello-client-bootstrap-1.6.0-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"katello-common-3.7.0-8.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"katello-debug-3.7.0-8.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"katello-installer-base-3.7.0.10-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"katello-selinux-3.0.3-2.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"katello-service-3.7.0-8.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"kobo-0.5.1-1.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"libwebsockets-2.1.0-3.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"libwebsockets-debuginfo-2.1.0-3.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"liquibase-3.1.0-1.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"livecd-tools-20.4-1.6.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"mod_passenger-4.0.18-24.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"mod_xsendfile-0.12-10.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"mod_xsendfile-debuginfo-0.12-10.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"ostree-2017.1-2.atomic.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"ostree-debuginfo-2017.1-2.atomic.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"pcp-mmvstatsd-0.4-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"pulp-admin-client-2.16.4.1-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"pulp-docker-admin-extensions-3.1.4.1-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"pulp-docker-plugins-3.1.4.1-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"pulp-katello-1.0.2-5.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"pulp-maintenance-2.16.4.1-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"pulp-ostree-admin-extensions-1.3.0-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"pulp-ostree-plugins-1.3.0-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"pulp-puppet-admin-extensions-2.16.4-3.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"pulp-puppet-plugins-2.16.4-3.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"pulp-puppet-tools-2.16.4-3.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"pulp-rpm-admin-extensions-2.16.4.1-5.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"pulp-rpm-plugins-2.16.4.1-5.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"pulp-selinux-2.16.4.1-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"pulp-server-2.16.4.1-1.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"puppet-agent-5.5.0-2.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"puppet-agent-oauth-0.5.1-3.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"puppet-foreman_scap_client-0.3.16-3.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"puppetlabs-stdlib-4.2.1-1.20140510git08b00d9.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"puppetserver-5.3.1-1.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"python-billiard-debuginfo-3.5.0.3-3.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"python-blinker-1.3-2.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"python-bson-3.2-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"python-crane-3.1.1-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"python-flask-0.10.1-4.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"python-fpconst-0.7.3-12.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"python-gnupg-0.3.7-1.el7ui")) flag++; if (rpm_check(release:"RHEL7", reference:"python-gofer-2.12.1-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"python-gofer-qpid-2.12.1-1.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"python-imgcreate-20.4-1.6.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"python-isodate-0.5.0-5.pulp.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"python-itsdangerous-0.23-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"python-jinja2-2.7.2-2.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"python-kid-0.9.6-11.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"python-mongoengine-0.10.5-2.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"python-nectar-1.5.6-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"python-oauth2-1.5.211-8.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"python-okaara-1.0.32-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"python-pulp-bindings-2.16.4.1-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"python-pulp-client-lib-2.16.4.1-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"python-pulp-common-2.16.4.1-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"python-pulp-docker-common-3.1.4.1-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"python-pulp-integrity-2.16.4.1-5.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"python-pulp-oid_validation-2.16.4.1-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"python-pulp-ostree-common-1.3.0-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"python-pulp-puppet-common-2.16.4-3.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"python-pulp-repoauth-2.16.4.1-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"python-pulp-rpm-common-2.16.4.1-5.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"python-pulp-streamer-2.16.4.1-1.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"python-pymongo-3.2-1.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"python-pymongo-debuginfo-3.2-1.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"python-pymongo-gridfs-3.2-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"python-qpid-1.35.0-5.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"python-qpid-proton-0.16.0-12.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"python-qpid-qmf-1.36.0-19.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"python-saslwrapper-0.22-5.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"python-semantic_version-2.2.0-6.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"python-simplejson-3.2.0-1.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"python-simplejson-debuginfo-3.2.0-1.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"python-twisted-core-12.2.0-4.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"python-twisted-core-debuginfo-12.2.0-4.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"python-twisted-web-12.1.0-5.el7_2")) flag++; if (rpm_check(release:"RHEL7", reference:"python-werkzeug-0.9.1-1.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"python-zope-interface-4.0.5-4.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"python-zope-interface-debuginfo-4.0.5-4.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"python2-amqp-2.2.2-3.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"python2-billiard-3.5.0.3-3.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"python2-celery-4.0.2-4.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"python2-django-1.11.11-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"python2-kombu-4.0.2-8.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"python2-vine-1.1.3-4.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"qpid-cpp-client-1.36.0-19.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"qpid-cpp-client-devel-1.36.0-19.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"qpid-cpp-debuginfo-1.36.0-19.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"qpid-cpp-server-1.36.0-19.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"qpid-cpp-server-linearstore-1.36.0-19.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"qpid-dispatch-debuginfo-0.8.0-19.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"qpid-dispatch-router-0.8.0-19.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"qpid-dispatch-tools-0.8.0-19.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"qpid-proton-c-0.16.0-12.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"qpid-proton-debuginfo-0.16.0-12.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"qpid-qmf-1.36.0-19.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"qpid-tools-1.36.0-19.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"redhat-access-insights-puppet-0.0.9-3.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"repoview-0.6.6-4.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"rubygem-ansi-1.4.3-3.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"rubygem-bundler_ext-0.4.1-3.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"rubygem-clamp-1.1.2-2.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"rubygem-concurrent-ruby-1.0.3-6.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"rubygem-facter-2.4.1-2.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"rubygem-fast_gettext-1.1.0-4.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"rubygem-ffi-1.4.0-3.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"rubygem-ffi-debuginfo-1.4.0-3.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"rubygem-foreman_scap_client-0.3.0-3.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"rubygem-gssapi-1.1.2-4.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"rubygem-hashie-2.0.5-5.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"rubygem-highline-1.7.8-3.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"rubygem-kafo-2.1.0-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"rubygem-kafo_parsers-0.1.6-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"rubygem-kafo_wizards-0.0.1-2.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"rubygem-little-plugger-1.1.3-22.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"rubygem-logging-2.2.2-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"rubygem-mime-types-1.19-7.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"rubygem-multi_json-1.12.2-2.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"rubygem-netrc-0.7.7-9.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"rubygem-newt-0.9.6-3.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"rubygem-newt-debuginfo-0.9.6-3.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"rubygem-oauth-0.5.4-2.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"rubygem-openscap-0.4.7-3.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"rubygem-passenger-4.0.18-24.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"rubygem-passenger-debuginfo-4.0.18-24.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"rubygem-passenger-native-4.0.18-24.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"rubygem-passenger-native-libs-4.0.18-24.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"rubygem-powerbar-1.0.17-2.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"rubygem-rake-0.9.2.2-41.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"rubygem-rb-inotify-0.9.7-4.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"rubygem-rest-client-1.6.7-7.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"rubygem-rkerberos-0.1.3-5.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"rubygem-rkerberos-debuginfo-0.1.3-5.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"rubygem-rsec-0.4.2-2.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"rubygem-rubyipmi-0.10.0-2.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"rubygem-smart_proxy_ansible-2.0.2-3.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"rubygem-smart_proxy_dhcp_remote_isc-0.0.4-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"rubygem-smart_proxy_discovery-1.0.4-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"rubygem-smart_proxy_discovery_image-1.0.9-2.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"rubygem-smart_proxy_dynflow-0.2.1-2.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"rubygem-smart_proxy_openscap-0.6.11-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"rubygem-smart_proxy_pulp-1.3.0-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"rubygem-smart_proxy_remote_execution_ssh-0.2.0-3.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"rubygem-tilt-1.3.7-2.git.0.3b416c9.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"saslwrapper-0.22-5.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"saslwrapper-debuginfo-0.22-5.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"satellite-6.4.0-15.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"satellite-capsule-6.4.0-15.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"satellite-cli-6.4.0-15.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"satellite-common-6.4.0-15.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"satellite-debug-tools-6.4.0-15.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"satellite-installer-6.4.0.7-2.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-ror51-rubygem-actioncable-5.1.6-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-ror51-rubygem-actionmailer-5.1.6-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-ror51-rubygem-actionpack-5.1.6-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-ror51-rubygem-actionview-5.1.6-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-ror51-rubygem-activejob-5.1.6-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-ror51-rubygem-activemodel-5.1.6-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-ror51-rubygem-activerecord-5.1.6-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-ror51-rubygem-activesupport-5.1.6-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-ror51-rubygem-arel-8.0.0-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-ror51-rubygem-builder-3.2.3-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-ror51-rubygem-coffee-rails-4.2.2-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-ror51-rubygem-coffee-script-2.4.1-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-ror51-rubygem-coffee-script-source-1.12.2-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-ror51-rubygem-concurrent-ruby-1.0.5-4.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-ror51-rubygem-crass-1.0.2-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-ror51-rubygem-erubi-1.7.0-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-ror51-rubygem-execjs-2.7.0-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-ror51-rubygem-globalid-0.4.1-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-ror51-rubygem-i18n-0.9.1-2.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-ror51-rubygem-loofah-2.1.1-2.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-ror51-rubygem-mail-2.7.0-2.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-ror51-rubygem-method_source-0.9.0-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-ror51-rubygem-mime-types-3.1-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-ror51-rubygem-mime-types-data-3.2016.0521-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-ror51-rubygem-mini_mime-1.0.0-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-ror51-rubygem-multi_json-1.12.2-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-ror51-rubygem-mustermann-1.0.1-1.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"tfm-ror51-rubygem-nio4r-2.1.0-1.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"tfm-ror51-rubygem-nio4r-debuginfo-2.1.0-1.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"tfm-ror51-rubygem-nokogiri-1.8.1-1.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"tfm-ror51-rubygem-nokogiri-debuginfo-1.8.1-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-ror51-rubygem-rack-2.0.3-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-ror51-rubygem-rack-protection-2.0.0-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-ror51-rubygem-rack-test-0.7.0-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-ror51-rubygem-rails-5.1.6-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-ror51-rubygem-rails-dom-testing-2.0.3-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-ror51-rubygem-rails-html-sanitizer-1.0.3-2.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-ror51-rubygem-railties-5.1.6-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-ror51-rubygem-sinatra-2.0.0-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-ror51-rubygem-sprockets-3.7.1-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-ror51-rubygem-sprockets-rails-3.2.1-1.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"tfm-ror51-rubygem-sqlite3-1.3.13-1.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"tfm-ror51-rubygem-sqlite3-debuginfo-1.3.13-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-ror51-rubygem-thor-0.20.0-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-ror51-rubygem-thread_safe-0.3.6-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-ror51-rubygem-tilt-2.0.8-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-ror51-rubygem-turbolinks-2.5.4-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-ror51-rubygem-tzinfo-1.2.4-2.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"tfm-ror51-rubygem-websocket-driver-0.6.5-2.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"tfm-ror51-rubygem-websocket-driver-debuginfo-0.6.5-2.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-ror51-rubygem-websocket-extensions-0.1.2-1.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"tfm-ror51-runtime-1.1-2.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-activerecord-session_store-1.1.0-6.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-addressable-2.3.6-5.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-algebrick-0.7.3-5.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-ancestry-3.0.0-2.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-anemone-0.7.2-19.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-angular-rails-templates-1.0.2-2.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-apipie-bindings-0.2.2-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-apipie-params-0.0.5-4.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-apipie-rails-0.5.7-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-audited-4.7.0-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-autoparse-0.3.3-9.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-awesome_print-1.8.0-2.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-bastion-6.1.11-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-bundler_ext-0.4.1-3.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-clamp-1.1.2-2.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-concurrent-ruby-edge-0.2.4-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-css_parser-1.4.7-2.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-daemons-1.2.3-6.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-deacon-1.0.0-3.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-deep_cloneable-2.2.2-2.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-deface-1.2.0-10.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-diffy-3.0.1-5.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-docker-api-1.28.0-3.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-domain_name-0.5.20160310-3.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-dynflow-1.0.5.1-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-excon-0.58.0-2.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-extlib-0.9.16-5.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"tfm-rubygem-facter-2.4.0-5.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-faraday-0.9.1-5.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-fast_gettext-1.4.1-2.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"tfm-rubygem-ffi-1.4.0-11.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"tfm-rubygem-ffi-debuginfo-1.4.0-11.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-fog-1.42.1-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-fog-aws-1.3.0-2.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-fog-core-1.45.0-2.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-fog-digitalocean-0.3.0-2.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-fog-google-0.1.0-4.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-fog-json-1.0.2-9.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-fog-libvirt-0.4.1-2.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-fog-openstack-0.1.25-2.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-fog-ovirt-1.1.2-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-fog-rackspace-0.1.4-2.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-fog-vsphere-2.3.0-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-fog-xenserver-0.2.3-3.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-fog-xml-0.1.2-6.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-foreman-redhat_access-2.0.13-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-foreman-tasks-0.13.4.2-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-foreman-tasks-core-0.2.5-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-foreman_ansible-2.2.9-2.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-foreman_ansible_core-2.1.1-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-foreman_bootdisk-12.0.0-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-foreman_discovery-12.0.2.1-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-foreman_docker-4.1.0-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-foreman_hooks-0.3.14.1-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-foreman_openscap-0.10.3-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-foreman_remote_execution-1.5.6-4.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-foreman_remote_execution_core-1.1.3-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-foreman_templates-6.0.3-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-foreman_theme_satellite-2.0.1.11-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-foreman_virt_who_configure-0.2.2-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-formatador-0.2.1-10.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-friendly_id-5.1.0-4.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-get_process_mem-0.2.1-2.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-gettext_i18n_rails-1.2.1-4.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-git-1.2.5-8.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-google-api-client-0.8.2-10.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-gssapi-1.2.0-4.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-hammer_cli-0.13.1-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-hammer_cli_csv-2.3.1-2.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-hammer_cli_foreman-0.13.2.1-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-hammer_cli_foreman_admin-0.0.8-2.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-hammer_cli_foreman_ansible-0.1.1-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-hammer_cli_foreman_bootdisk-0.1.3.3-3.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-hammer_cli_foreman_discovery-1.0.0-2.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-hammer_cli_foreman_docker-0.0.6-3.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-hammer_cli_foreman_openscap-0.1.6-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-hammer_cli_foreman_remote_execution-0.1.0-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-hammer_cli_foreman_tasks-0.0.12-2.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-hammer_cli_foreman_templates-0.1.0-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-hammer_cli_foreman_virt_who_configure-0.0.3-2.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-hammer_cli_katello-0.13.4.3-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-hashie-2.0.5-5.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-highline-1.7.8-3.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-http-cookie-1.0.2-4.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-ipaddress-0.8.0-10.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-jgrep-1.3.3-11.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-journald-logger-2.0.3-1.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"tfm-rubygem-journald-native-1.0.10-1.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"tfm-rubygem-journald-native-debuginfo-1.0.10-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-jwt-1.2.0-5.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-katello-3.7.0.41-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-launchy-2.4.3-5.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-ldap_fluff-0.4.7-2.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-little-plugger-1.1.3-22.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-locale-2.0.9-12.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-logging-2.2.2-4.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-logging-journald-1.0.0-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-multipart-post-1.2.0-5.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-net-ldap-0.15.0-2.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-net-ping-2.0.1-2.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-net-scp-1.2.1-2.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-net-ssh-4.0.1-4.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-net-ssh-krb-0.4.0-2.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-netrc-0.11.0-2.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-oauth-0.5.4-2.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"tfm-rubygem-ovirt-engine-sdk-4.2.3-1.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"tfm-rubygem-ovirt-engine-sdk-debuginfo-4.2.3-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-ovirt_provision_plugin-1.0.2-2.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-parse-cron-0.1.4-3.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"tfm-rubygem-passenger-4.0.18-24.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"tfm-rubygem-passenger-debuginfo-4.0.18-24.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"tfm-rubygem-passenger-native-4.0.18-24.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"tfm-rubygem-passenger-native-libs-4.0.18-24.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"tfm-rubygem-pg-0.21.0-2.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"tfm-rubygem-pg-debuginfo-0.21.0-2.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-polyglot-0.3.5-2.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-powerbar-1.0.17-2.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-prometheus-client-0.7.1-1.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"tfm-rubygem-qpid_messaging-1.36.0-2.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"tfm-rubygem-qpid_messaging-debuginfo-1.36.0-2.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-quantile-0.2.0-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-rabl-0.13.1-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-rack-jsonp-1.3.1-6.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-rails-i18n-5.0.4-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-rainbow-2.2.1-4.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-rbovirt-0.1.7-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-rbvmomi-1.10.0-2.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-record_tag_helper-1.0.0-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-redhat_access-2.1.6-2.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-redhat_access_lib-1.1.4-2.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-responders-2.4.0-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-rest-client-2.0.1-2.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-retriable-1.4.1-5.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-roadie-3.2.2-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-roadie-rails-1.2.1-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-robotex-1.0.0-20.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"tfm-rubygem-ruby-libvirt-0.7.0-3.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"tfm-rubygem-ruby-libvirt-debuginfo-0.7.0-3.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-ruby2ruby-2.4.0-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-ruby_parser-3.10.1-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-runcible-2.8.1-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-safemode-1.3.5-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-scoped_search-4.1.3-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-secure_headers-5.0.5-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-sequel-5.7.1-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-sexp_processor-4.10.0-4.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-signet-0.6.0-9.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-smart_proxy_dynflow_core-0.2.1-2.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-sshkey-1.9.0-2.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-statsd-instrument-2.1.4-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-trollop-2.1.2-2.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-unf-0.1.3-6.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"tfm-rubygem-unf_ext-0.0.6-8.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"tfm-rubygem-unf_ext-debuginfo-0.0.6-8.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"tfm-rubygem-unicode-0.4.4.1-5.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"tfm-rubygem-unicode-debuginfo-0.4.4.1-5.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-unicode-display_width-1.0.5-4.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-useragent-0.16.8-2.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-validates_lengths_from_database-0.5.0-4.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-webpack-rails-0.9.8-4.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-wicked-1.3.2-1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-will_paginate-3.1.5-2.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"tfm-rubygem-x-editable-rails-1.5.5-3.el7")) flag++; if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"tfm-runtime-4.0-3.el7")) flag++; if (flag) { security_report_v4( port : 0, severity : SECURITY_HOLE, extra : rpm_report_get() + redhat_report_package_caveat() ); exit(0); } else { tested = pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "SOAPpy / ansiblerole-insights-client / candlepin / etc"); } }

NASL family	FreeBSD Local Security Checks
NASL id	FREEBSD_PKG_DC880D6C195D11E78C630800277DCC69.NASL
description	Django team reports : These release addresses two security issues detailed below. We encourage all users of Django to upgrade as soon as possible. - Open redirect and possible XSS attack via user-supplied numeric redirect URLs - Open redirect vulnerability in django.views.static.serve()
last seen	2020-06-01
modified	2020-06-02
plugin id	99193
published	2017-04-05
reporter	This script is Copyright (C) 2017-2018 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/99193
title	FreeBSD : django -- multiple vulnerabilities (dc880d6c-195d-11e7-8c63-0800277dcc69)
code	# # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from the FreeBSD VuXML database : # # Copyright 2003-2018 Jacques Vidrine and contributors # # Redistribution and use in source (VuXML) and 'compiled' forms (SGML, # HTML, PDF, PostScript, RTF and so forth) with or without modification, # are permitted provided that the following conditions are met: # 1. Redistributions of source code (VuXML) must retain the above # copyright notice, this list of conditions and the following # disclaimer as the first lines of this file unmodified. # 2. Redistributions in compiled form (transformed to other DTDs, # published online in any format, converted to PDF, PostScript, # RTF and other formats) must reproduce the above copyright # notice, this list of conditions and the following disclaimer # in the documentation and/or other materials provided with the # distribution. # # THIS DOCUMENTATION IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS "AS IS" # AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, # THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR # PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS # BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, # OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT # OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR # BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, # WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE # OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS DOCUMENTATION, # EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. # include("compat.inc"); if (description) { script_id(99193); script_version("3.6"); script_cvs_date("Date: 2018/11/10 11:49:46"); script_cve_id("CVE-2017-7233", "CVE-2017-7234"); script_name(english:"FreeBSD : django -- multiple vulnerabilities (dc880d6c-195d-11e7-8c63-0800277dcc69)"); script_summary(english:"Checks for updated packages in pkg_info output"); script_set_attribute( attribute:"synopsis", value: "The remote FreeBSD host is missing one or more security-related updates." ); script_set_attribute( attribute:"description", value: "Django team reports : These release addresses two security issues detailed below. We encourage all users of Django to upgrade as soon as possible. - Open redirect and possible XSS attack via user-supplied numeric redirect URLs - Open redirect vulnerability in django.views.static.serve()" ); script_set_attribute( attribute:"see_also", value:"https://www.djangoproject.com/weblog/2017/apr/04/security-releases/" ); # https://vuxml.freebsd.org/freebsd/dc880d6c-195d-11e7-8c63-0800277dcc69.html script_set_attribute( attribute:"see_also", value:"http://www.nessus.org/u?38ddf117" ); script_set_attribute(attribute:"solution", value:"Update the affected packages."); script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:N"); script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:py27-django"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:py27-django110"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:py27-django18"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:py27-django19"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:py33-django"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:py33-django110"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:py33-django18"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:py33-django19"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:py34-django"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:py34-django110"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:py34-django18"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:py34-django19"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:py35-django"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:py35-django110"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:py35-django18"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:py35-django19"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:py36-django"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:py36-django110"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:py36-django18"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:py36-django19"); script_set_attribute(attribute:"cpe", value:"cpe:/o:freebsd:freebsd"); script_set_attribute(attribute:"vuln_publication_date", value:"2017/04/04"); script_set_attribute(attribute:"patch_publication_date", value:"2017/04/04"); script_set_attribute(attribute:"plugin_publication_date", value:"2017/04/05"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2017-2018 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"FreeBSD Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/FreeBSD/release", "Host/FreeBSD/pkg_info"); exit(0); } include("audit.inc"); include("freebsd_package.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); if (!get_kb_item("Host/FreeBSD/release")) audit(AUDIT_OS_NOT, "FreeBSD"); if (!get_kb_item("Host/FreeBSD/pkg_info")) audit(AUDIT_PACKAGE_LIST_MISSING); flag = 0; if (pkg_test(save_report:TRUE, pkg:"py27-django<1.8.18")) flag++; if (pkg_test(save_report:TRUE, pkg:"py33-django<1.8.18")) flag++; if (pkg_test(save_report:TRUE, pkg:"py34-django<1.8.18")) flag++; if (pkg_test(save_report:TRUE, pkg:"py35-django<1.8.18")) flag++; if (pkg_test(save_report:TRUE, pkg:"py36-django<1.8.18")) flag++; if (pkg_test(save_report:TRUE, pkg:"py27-django18<1.8.18")) flag++; if (pkg_test(save_report:TRUE, pkg:"py33-django18<1.8.18")) flag++; if (pkg_test(save_report:TRUE, pkg:"py34-django18<1.8.18")) flag++; if (pkg_test(save_report:TRUE, pkg:"py35-django18<1.8.18")) flag++; if (pkg_test(save_report:TRUE, pkg:"py36-django18<1.8.18")) flag++; if (pkg_test(save_report:TRUE, pkg:"py27-django19<1.9.13")) flag++; if (pkg_test(save_report:TRUE, pkg:"py33-django19<1.9.13")) flag++; if (pkg_test(save_report:TRUE, pkg:"py34-django19<1.9.13")) flag++; if (pkg_test(save_report:TRUE, pkg:"py35-django19<1.9.13")) flag++; if (pkg_test(save_report:TRUE, pkg:"py36-django19<1.9.13")) flag++; if (pkg_test(save_report:TRUE, pkg:"py27-django110<1.10.7")) flag++; if (pkg_test(save_report:TRUE, pkg:"py33-django110<1.10.7")) flag++; if (pkg_test(save_report:TRUE, pkg:"py34-django110<1.10.7")) flag++; if (pkg_test(save_report:TRUE, pkg:"py35-django110<1.10.7")) flag++; if (pkg_test(save_report:TRUE, pkg:"py36-django110<1.10.7")) flag++; if (flag) { if (report_verbosity > 0) security_warning(port:0, extra:pkg_report_get()); else security_warning(0); exit(0); } else audit(AUDIT_HOST_NOT, "affected");

NASL family	Ubuntu Local Security Checks
NASL id	UBUNTU_USN-3254-1.NASL
description	It was discovered that Django incorrectly handled numeric redirect URLs. A remote attacker could possibly use this issue to perform XSS attacks, and to use a Django server as an open redirect. (CVE-2017-7233) Phithon Gong discovered that Django incorrectly handled certain URLs when the jango.views.static.serve() view is being used. A remote attacker could possibly use a Django server as an open redirect. (CVE-2017-7234). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	99195
published	2017-04-05
reporter	Ubuntu Security Notice (C) 2017-2019 Canonical, Inc. / NASL script (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/99195
title	Ubuntu 12.04 LTS / 14.04 LTS / 16.04 LTS / 16.10 : python-django vulnerabilities (USN-3254-1)
code	# # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from Ubuntu Security Notice USN-3254-1. The text # itself is copyright (C) Canonical, Inc. See # <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered # trademark of Canonical, Inc. # include("compat.inc"); if (description) { script_id(99195); script_version("3.8"); script_cvs_date("Date: 2019/09/18 12:31:46"); script_cve_id("CVE-2017-7233", "CVE-2017-7234"); script_xref(name:"USN", value:"3254-1"); script_name(english:"Ubuntu 12.04 LTS / 14.04 LTS / 16.04 LTS / 16.10 : python-django vulnerabilities (USN-3254-1)"); script_summary(english:"Checks dpkg output for updated packages."); script_set_attribute( attribute:"synopsis", value: "The remote Ubuntu host is missing one or more security-related patches." ); script_set_attribute( attribute:"description", value: "It was discovered that Django incorrectly handled numeric redirect URLs. A remote attacker could possibly use this issue to perform XSS attacks, and to use a Django server as an open redirect. (CVE-2017-7233) Phithon Gong discovered that Django incorrectly handled certain URLs when the jango.views.static.serve() view is being used. A remote attacker could possibly use a Django server as an open redirect. (CVE-2017-7234). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues." ); script_set_attribute( attribute:"see_also", value:"https://usn.ubuntu.com/3254-1/" ); script_set_attribute( attribute:"solution", value:"Update the affected python-django and / or python3-django packages." ); script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:N"); script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C"); script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"); script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available"); script_set_attribute(attribute:"exploit_available", value:"false"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:python-django"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:python3-django"); script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:12.04:-:lts"); script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:14.04"); script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:16.04"); script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:16.10"); script_set_attribute(attribute:"vuln_publication_date", value:"2017/04/04"); script_set_attribute(attribute:"patch_publication_date", value:"2017/04/04"); script_set_attribute(attribute:"plugin_publication_date", value:"2017/04/05"); script_set_attribute(attribute:"generated_plugin", value:"current"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"Ubuntu Security Notice (C) 2017-2019 Canonical, Inc. / NASL script (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"Ubuntu Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/cpu", "Host/Ubuntu", "Host/Ubuntu/release", "Host/Debian/dpkg-l"); exit(0); } include("audit.inc"); include("ubuntu.inc"); include("misc_func.inc"); if ( ! get_kb_item("Host/local_checks_enabled") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/Ubuntu/release"); if ( isnull(release) ) audit(AUDIT_OS_NOT, "Ubuntu"); release = chomp(release); if (! preg(pattern:"^(12\.04\|14\.04\|16\.04\|16\.10)$", string:release)) audit(AUDIT_OS_NOT, "Ubuntu 12.04 / 14.04 / 16.04 / 16.10", "Ubuntu " + release); if ( ! get_kb_item("Host/Debian/dpkg-l") ) audit(AUDIT_PACKAGE_LIST_MISSING); cpu = get_kb_item("Host/cpu"); if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH); if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Ubuntu", cpu); flag = 0; if (ubuntu_check(osver:"12.04", pkgname:"python-django", pkgver:"1.3.1-4ubuntu1.23")) flag++; if (ubuntu_check(osver:"14.04", pkgname:"python-django", pkgver:"1.6.11-0ubuntu1.1")) flag++; if (ubuntu_check(osver:"16.04", pkgname:"python-django", pkgver:"1.8.7-1ubuntu5.5")) flag++; if (ubuntu_check(osver:"16.04", pkgname:"python3-django", pkgver:"1.8.7-1ubuntu5.5")) flag++; if (ubuntu_check(osver:"16.10", pkgname:"python-django", pkgver:"1.8.7-1ubuntu8.2")) flag++; if (ubuntu_check(osver:"16.10", pkgname:"python3-django", pkgver:"1.8.7-1ubuntu8.2")) flag++; if (flag) { security_report_v4( port : 0, severity : SECURITY_WARNING, extra : ubuntu_report_get() ); exit(0); } else { tested = ubuntu_pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "python-django / python3-django"); }

NASL family	Debian Local Security Checks
NASL id	DEBIAN_DLA-885.NASL
description	It was discovered that there were two vulnerabilities in python-django, a high-level Python web development framework. CVE-2017-7233 (#859515): Open redirect and possible XSS attack via user-supplied numeric redirect URLs. Django relies on user input in some cases (e.g. django.contrib.auth.views.login() and i18n) to redirect the user to an
last seen	2020-03-17
modified	2017-04-06
plugin id	99202
published	2017-04-06
reporter	This script is Copyright (C) 2017-2020 Tenable Network Security, Inc.
source	https://www.tenable.com/plugins/nessus/99202
title	Debian DLA-885-1 : python-django security update
code	#%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from Debian Security Advisory DLA-885-1. The text # itself is copyright (C) Software in the Public Interest, Inc. # include("compat.inc"); if (description) { script_id(99202); script_version("3.6"); script_set_attribute(attribute:"plugin_modification_date", value:"2020/03/12"); script_cve_id("CVE-2017-7233", "CVE-2017-7234"); script_name(english:"Debian DLA-885-1 : python-django security update"); script_summary(english:"Checks dpkg output for the updated packages."); script_set_attribute( attribute:"synopsis", value:"The remote Debian host is missing a security update." ); script_set_attribute( attribute:"description", value: "It was discovered that there were two vulnerabilities in python-django, a high-level Python web development framework. CVE-2017-7233 (#859515): Open redirect and possible XSS attack via user-supplied numeric redirect URLs. Django relies on user input in some cases (e.g. django.contrib.auth.views.login() and i18n) to redirect the user to an 'on success' URL. The security check for these redirects (namely is_safe_url()) considered some numeric URLs (e.g. http:999999999) 'safe' when they shouldn't be. Also, if a developer relied on is_safe_url() to provide safe redirect targets and puts such a URL into a link, they could suffer from an XSS attack. CVE-2017-7234 (#895516): Open redirect vulnerability in django.views.static.serve; A maliciously crafted URL to a Django site using the serve() view could redirect to any other domain. The view no longer does any redirects as they don't provide any known, useful functionality. For Debian 7 'Wheezy', this issue has been fixed in python-django version 1.4.22-1+deb7u3. We recommend that you upgrade your python-django packages. NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues." ); script_set_attribute( attribute:"see_also", value:"https://lists.debian.org/debian-lts-announce/2017/04/msg00004.html" ); script_set_attribute( attribute:"see_also", value:"https://packages.debian.org/source/wheezy/python-django" ); script_set_attribute( attribute:"solution", value:"Upgrade the affected python-django, and python-django-doc packages." ); script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:N"); script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C"); script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"); script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available"); script_set_attribute(attribute:"exploit_available", value:"false"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:python-django"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:python-django-doc"); script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:7.0"); script_set_attribute(attribute:"patch_publication_date", value:"2017/04/05"); script_set_attribute(attribute:"plugin_publication_date", value:"2017/04/06"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2017-2020 Tenable Network Security, Inc."); script_family(english:"Debian Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l"); exit(0); } include("audit.inc"); include("debian_package.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); if (!get_kb_item("Host/Debian/release")) audit(AUDIT_OS_NOT, "Debian"); if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING); flag = 0; if (deb_check(release:"7.0", prefix:"python-django", reference:"1.4.22-1+deb7u3")) flag++; if (deb_check(release:"7.0", prefix:"python-django-doc", reference:"1.4.22-1+deb7u3")) flag++; if (flag) { if (report_verbosity > 0) security_warning(port:0, extra:deb_report_get()); else security_warning(0); exit(0); } else audit(AUDIT_HOST_NOT, "affected");

NASL family	Fedora Local Security Checks
NASL id	FEDORA_2017-F997E46FA7.NASL
description	fix CVE-2017-7233 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-05
modified	2017-07-17
plugin id	101750
published	2017-07-17
reporter	This script is Copyright (C) 2017-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/101750
title	Fedora 26 : python-django (2017-f997e46fa7)
code	#%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from Fedora Security Advisory FEDORA-2017-f997e46fa7. # include("compat.inc"); if (description) { script_id(101750); script_version("3.4"); script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/04"); script_cve_id("CVE-2017-7233"); script_xref(name:"FEDORA", value:"2017-f997e46fa7"); script_name(english:"Fedora 26 : python-django (2017-f997e46fa7)"); script_summary(english:"Checks rpm output for the updated package."); script_set_attribute( attribute:"synopsis", value:"The remote Fedora host is missing a security update." ); script_set_attribute( attribute:"description", value: "fix CVE-2017-7233 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues." ); script_set_attribute( attribute:"see_also", value:"https://bodhi.fedoraproject.org/updates/FEDORA-2017-f997e46fa7" ); script_set_attribute( attribute:"solution", value:"Update the affected python-django package." ); script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:N"); script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:python-django"); script_set_attribute(attribute:"cpe", value:"cpe:/o:fedoraproject:fedora:26"); script_set_attribute(attribute:"vuln_publication_date", value:"2017/04/04"); script_set_attribute(attribute:"patch_publication_date", value:"2017/04/21"); script_set_attribute(attribute:"plugin_publication_date", value:"2017/07/17"); script_set_attribute(attribute:"generated_plugin", value:"current"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2017-2020 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"Fedora Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/RedHat/release"); if (isnull(release) \|\| "Fedora" >!< release) audit(AUDIT_OS_NOT, "Fedora"); os_ver = pregmatch(pattern: "Fedora.*release ([0-9]+)", string:release); if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Fedora"); os_ver = os_ver[1]; if (! preg(pattern:"^26([^0-9]\|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Fedora 26", "Fedora " + os_ver); if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); cpu = get_kb_item("Host/cpu"); if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH); if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Fedora", cpu); flag = 0; if (rpm_check(release:"FC26", reference:"python-django-1.10.7-1.fc26")) flag++; if (flag) { security_report_v4( port : 0, severity : SECURITY_WARNING, extra : rpm_report_get() ); exit(0); } else { tested = pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "python-django"); }

NASL family	Debian Local Security Checks
NASL id	DEBIAN_DSA-3835.NASL
description	Several vulnerabilities were discovered in Django, a high-level Python web development framework. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2016-9013 Marti Raudsepp reported that a user with a hard-coded password is created when running tests with an Oracle database. - CVE-2016-9014 Aymeric Augustin discovered that Django does not properly validate the Host header against settings.ALLOWED_HOSTS when the debug setting is enabled. A remote attacker can take advantage of this flaw to perform DNS rebinding attacks. - CVE-2017-7233 It was discovered that is_safe_url() does not properly handle certain numeric URLs as safe. A remote attacker can take advantage of this flaw to perform XSS attacks or to use a Django server as an open redirect. - CVE-2017-7234 Phithon from Chaitin Tech discovered an open redirect vulnerability in the django.views.static.serve() view. Note that this view is not intended for production use.
last seen	2020-06-01
modified	2020-06-02
plugin id	99695
published	2017-04-27
reporter	This script is Copyright (C) 2017-2018 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/99695
title	Debian DSA-3835-1 : python-django - security update
code	# # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from Debian Security Advisory DSA-3835. The text # itself is copyright (C) Software in the Public Interest, Inc. # include("compat.inc"); if (description) { script_id(99695); script_version("3.5"); script_cvs_date("Date: 2018/11/10 11:49:38"); script_cve_id("CVE-2016-9013", "CVE-2016-9014", "CVE-2017-7233", "CVE-2017-7234"); script_xref(name:"DSA", value:"3835"); script_name(english:"Debian DSA-3835-1 : python-django - security update"); script_summary(english:"Checks dpkg output for the updated package"); script_set_attribute( attribute:"synopsis", value:"The remote Debian host is missing a security-related update." ); script_set_attribute( attribute:"description", value: "Several vulnerabilities were discovered in Django, a high-level Python web development framework. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2016-9013 Marti Raudsepp reported that a user with a hard-coded password is created when running tests with an Oracle database. - CVE-2016-9014 Aymeric Augustin discovered that Django does not properly validate the Host header against settings.ALLOWED_HOSTS when the debug setting is enabled. A remote attacker can take advantage of this flaw to perform DNS rebinding attacks. - CVE-2017-7233 It was discovered that is_safe_url() does not properly handle certain numeric URLs as safe. A remote attacker can take advantage of this flaw to perform XSS attacks or to use a Django server as an open redirect. - CVE-2017-7234 Phithon from Chaitin Tech discovered an open redirect vulnerability in the django.views.static.serve() view. Note that this view is not intended for production use." ); script_set_attribute( attribute:"see_also", value:"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=842856" ); script_set_attribute( attribute:"see_also", value:"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=859515" ); script_set_attribute( attribute:"see_also", value:"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=859516" ); script_set_attribute( attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2016-9013" ); script_set_attribute( attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2016-9014" ); script_set_attribute( attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2017-7233" ); script_set_attribute( attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2017-7234" ); script_set_attribute( attribute:"see_also", value:"https://packages.debian.org/source/jessie/python-django" ); script_set_attribute( attribute:"see_also", value:"https://www.debian.org/security/2017/dsa-3835" ); script_set_attribute( attribute:"solution", value: "Upgrade the python-django packages. For the stable distribution (jessie), these problems have been fixed in version 1.7.11-1+deb8u2." ); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P"); script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C"); script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"); script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available"); script_set_attribute(attribute:"exploit_available", value:"false"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:python-django"); script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:8.0"); script_set_attribute(attribute:"patch_publication_date", value:"2017/04/26"); script_set_attribute(attribute:"plugin_publication_date", value:"2017/04/27"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2017-2018 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"Debian Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l"); exit(0); } include("audit.inc"); include("debian_package.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); if (!get_kb_item("Host/Debian/release")) audit(AUDIT_OS_NOT, "Debian"); if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING); flag = 0; if (deb_check(release:"8.0", prefix:"python-django", reference:"1.7.11-1+deb8u2")) flag++; if (deb_check(release:"8.0", prefix:"python-django-common", reference:"1.7.11-1+deb8u2")) flag++; if (deb_check(release:"8.0", prefix:"python-django-doc", reference:"1.7.11-1+deb8u2")) flag++; if (deb_check(release:"8.0", prefix:"python3-django", reference:"1.7.11-1+deb8u2")) flag++; if (flag) { if (report_verbosity > 0) security_hole(port:0, extra:deb_report_get()); else security_hole(0); exit(0); } else audit(AUDIT_HOST_NOT, "affected");

NASL family	Fedora Local Security Checks
NASL id	FEDORA_2017-C0EF6054D7.NASL
description	update to 1.9.13, fix for CVE-2017-7233 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-05
modified	2017-04-24
plugin id	99613
published	2017-04-24
reporter	This script is Copyright (C) 2017-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/99613
title	Fedora 25 : python-django (2017-c0ef6054d7)
code	#%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from Fedora Security Advisory FEDORA-2017-c0ef6054d7. # include("compat.inc"); if (description) { script_id(99613); script_version("3.4"); script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/04"); script_cve_id("CVE-2017-7233"); script_xref(name:"FEDORA", value:"2017-c0ef6054d7"); script_name(english:"Fedora 25 : python-django (2017-c0ef6054d7)"); script_summary(english:"Checks rpm output for the updated package."); script_set_attribute( attribute:"synopsis", value:"The remote Fedora host is missing a security update." ); script_set_attribute( attribute:"description", value: "update to 1.9.13, fix for CVE-2017-7233 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues." ); script_set_attribute( attribute:"see_also", value:"https://bodhi.fedoraproject.org/updates/FEDORA-2017-c0ef6054d7" ); script_set_attribute( attribute:"solution", value:"Update the affected python-django package." ); script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:N"); script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:python-django"); script_set_attribute(attribute:"cpe", value:"cpe:/o:fedoraproject:fedora:25"); script_set_attribute(attribute:"vuln_publication_date", value:"2017/04/04"); script_set_attribute(attribute:"patch_publication_date", value:"2017/04/22"); script_set_attribute(attribute:"plugin_publication_date", value:"2017/04/24"); script_set_attribute(attribute:"generated_plugin", value:"current"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2017-2020 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"Fedora Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/RedHat/release"); if (isnull(release) \|\| "Fedora" >!< release) audit(AUDIT_OS_NOT, "Fedora"); os_ver = pregmatch(pattern: "Fedora.*release ([0-9]+)", string:release); if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Fedora"); os_ver = os_ver[1]; if (! preg(pattern:"^25([^0-9]\|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Fedora 25", "Fedora " + os_ver); if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); cpu = get_kb_item("Host/cpu"); if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH); if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Fedora", cpu); flag = 0; if (rpm_check(release:"FC25", reference:"python-django-1.9.13-1.fc25")) flag++; if (flag) { security_report_v4( port : 0, severity : SECURITY_WARNING, extra : rpm_report_get() ); exit(0); } else { tested = pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "python-django"); }

NASL family	SuSE Local Security Checks
NASL id	OPENSUSE-2018-318.NASL
description	This update for python3-Django to version 1.18.18 fixes multiple issues. Security issues fixed : - CVE-2018-7537: Fixed catastrophic backtracking in django.utils.text.Truncator. (bsc#1083305) - CVE-2018-7536: Fixed catastrophic backtracking in urlize and urlizetrunc template filters (bsc#1083304). - CVE-2016-7401: CSRF protection bypass on a site with Google Analytics (bsc#1001374). - CVE-2016-2513: User enumeration through timing difference on password hasher work factor upgrade (bsc#968000). - CVE-2016-2512: Fixed malicious redirect and possible XSS attack via user-supplied redirect URLs containing basic auth (bsc#967999). - CVE-2016-9013: User with hardcoded password created when running tests on Oracle (bsc#1008050). - CVE-2016-9014: DNS rebinding vulnerability when DEBUG=True (bsc#1008047). - CVE-2017-7234: Open redirect vulnerability in django.views.static.serve() (bsc#1031451). - CVE-2017-7233: Open redirect and possible XSS attack via user-supplied numeric redirect URLs (bsc#1031450). - CVE-2017-12794: Fixed XSS possibility in traceback section of technical 500 debug page (bsc#1056284)
last seen	2020-06-05
modified	2018-03-27
plugin id	108641
published	2018-03-27
reporter	This script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/108641
title	openSUSE Security Update : python3-Django (openSUSE-2018-318)
code	#%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from openSUSE Security Update openSUSE-2018-318. # # The text description of this plugin is (C) SUSE LLC. # include("compat.inc"); if (description) { script_id(108641); script_version("1.3"); script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/04"); script_cve_id("CVE-2016-2048", "CVE-2016-2512", "CVE-2016-2513", "CVE-2016-6186", "CVE-2016-7401", "CVE-2016-9013", "CVE-2016-9014", "CVE-2017-12794", "CVE-2017-7233", "CVE-2017-7234", "CVE-2018-7536", "CVE-2018-7537"); script_name(english:"openSUSE Security Update : python3-Django (openSUSE-2018-318)"); script_summary(english:"Check for the openSUSE-2018-318 patch"); script_set_attribute( attribute:"synopsis", value:"The remote openSUSE host is missing a security update." ); script_set_attribute( attribute:"description", value: "This update for python3-Django to version 1.18.18 fixes multiple issues. Security issues fixed : - CVE-2018-7537: Fixed catastrophic backtracking in django.utils.text.Truncator. (bsc#1083305) - CVE-2018-7536: Fixed catastrophic backtracking in urlize and urlizetrunc template filters (bsc#1083304). - CVE-2016-7401: CSRF protection bypass on a site with Google Analytics (bsc#1001374). - CVE-2016-2513: User enumeration through timing difference on password hasher work factor upgrade (bsc#968000). - CVE-2016-2512: Fixed malicious redirect and possible XSS attack via user-supplied redirect URLs containing basic auth (bsc#967999). - CVE-2016-9013: User with hardcoded password created when running tests on Oracle (bsc#1008050). - CVE-2016-9014: DNS rebinding vulnerability when DEBUG=True (bsc#1008047). - CVE-2017-7234: Open redirect vulnerability in django.views.static.serve() (bsc#1031451). - CVE-2017-7233: Open redirect and possible XSS attack via user-supplied numeric redirect URLs (bsc#1031450). - CVE-2017-12794: Fixed XSS possibility in traceback section of technical 500 debug page (bsc#1056284)" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1001374" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1008047" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1008050" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1031450" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1031451" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1056284" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1083304" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1083305" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.opensuse.org/show_bug.cgi?id=967999" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.opensuse.org/show_bug.cgi?id=968000" ); script_set_attribute( attribute:"solution", value:"Update the affected python3-Django package." ); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P"); script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C"); script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"); script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available"); script_set_attribute(attribute:"exploit_available", value:"true"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:python3-Django"); script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:42.3"); script_set_attribute(attribute:"patch_publication_date", value:"2018/03/27"); script_set_attribute(attribute:"plugin_publication_date", value:"2018/03/27"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"SuSE Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/SuSE/release"); if (isnull(release) \|\| release =~ "^(SLED\|SLES)") audit(AUDIT_OS_NOT, "openSUSE"); if (release !~ "^(SUSE42\.3)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "42.3", release); if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); flag = 0; if ( rpm_check(release:"SUSE42.3", reference:"python3-Django-1.8.19-5.3.1") ) flag++; if (flag) { if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get()); else security_hole(0); exit(0); } else { tested = pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "python3-Django"); }

NASL family	SuSE Local Security Checks
NASL id	OPENSUSE-2018-317.NASL
description	This update for python-Django to version 1.18.18 fixes multiple issues. Security issues fixed : - CVE-2018-7537: Fixed catastrophic backtracking in django.utils.text.Truncator. (bsc#1083305) - CVE-2018-7536: Fixed catastrophic backtracking in urlize and urlizetrunc template filters (bsc#1083304). - CVE-2016-7401: CSRF protection bypass on a site with Google Analytics (bsc#1001374). - CVE-2016-2513: User enumeration through timing difference on password hasher work factor upgrade (bsc#968000). - CVE-2016-2512: Fixed malicious redirect and possible XSS attack via user-supplied redirect URLs containing basic auth (bsc#967999). - CVE-2016-9013: User with hardcoded password created when running tests on Oracle (bsc#1008050). - CVE-2016-9014: DNS rebinding vulnerability when DEBUG=True (bsc#1008047). - CVE-2017-7234: Open redirect vulnerability in django.views.static.serve() (bsc#1031451). - CVE-2017-7233: Open redirect and possible XSS attack via user-supplied numeric redirect URLs (bsc#1031450). - CVE-2017-12794: Fixed XSS possibility in traceback section of technical 500 debug page (bsc#1056284)
last seen	2020-06-05
modified	2018-03-27
plugin id	108640
published	2018-03-27
reporter	This script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/108640
title	openSUSE Security Update : python-Django (openSUSE-2018-317)
code	#%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from openSUSE Security Update openSUSE-2018-317. # # The text description of this plugin is (C) SUSE LLC. # include("compat.inc"); if (description) { script_id(108640); script_version("1.3"); script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/04"); script_cve_id("CVE-2016-2048", "CVE-2016-2512", "CVE-2016-2513", "CVE-2016-6186", "CVE-2016-7401", "CVE-2016-9013", "CVE-2016-9014", "CVE-2017-12794", "CVE-2017-7233", "CVE-2017-7234", "CVE-2018-7536", "CVE-2018-7537"); script_name(english:"openSUSE Security Update : python-Django (openSUSE-2018-317)"); script_summary(english:"Check for the openSUSE-2018-317 patch"); script_set_attribute( attribute:"synopsis", value:"The remote openSUSE host is missing a security update." ); script_set_attribute( attribute:"description", value: "This update for python-Django to version 1.18.18 fixes multiple issues. Security issues fixed : - CVE-2018-7537: Fixed catastrophic backtracking in django.utils.text.Truncator. (bsc#1083305) - CVE-2018-7536: Fixed catastrophic backtracking in urlize and urlizetrunc template filters (bsc#1083304). - CVE-2016-7401: CSRF protection bypass on a site with Google Analytics (bsc#1001374). - CVE-2016-2513: User enumeration through timing difference on password hasher work factor upgrade (bsc#968000). - CVE-2016-2512: Fixed malicious redirect and possible XSS attack via user-supplied redirect URLs containing basic auth (bsc#967999). - CVE-2016-9013: User with hardcoded password created when running tests on Oracle (bsc#1008050). - CVE-2016-9014: DNS rebinding vulnerability when DEBUG=True (bsc#1008047). - CVE-2017-7234: Open redirect vulnerability in django.views.static.serve() (bsc#1031451). - CVE-2017-7233: Open redirect and possible XSS attack via user-supplied numeric redirect URLs (bsc#1031450). - CVE-2017-12794: Fixed XSS possibility in traceback section of technical 500 debug page (bsc#1056284)" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1001374" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1008047" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1008050" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1031450" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1031451" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1056284" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1083304" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1083305" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.opensuse.org/show_bug.cgi?id=967999" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.opensuse.org/show_bug.cgi?id=968000" ); script_set_attribute( attribute:"solution", value:"Update the affected python-Django package." ); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P"); script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C"); script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"); script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available"); script_set_attribute(attribute:"exploit_available", value:"true"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:python-Django"); script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:42.3"); script_set_attribute(attribute:"patch_publication_date", value:"2018/03/27"); script_set_attribute(attribute:"plugin_publication_date", value:"2018/03/27"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"SuSE Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/SuSE/release"); if (isnull(release) \|\| release =~ "^(SLED\|SLES)") audit(AUDIT_OS_NOT, "openSUSE"); if (release !~ "^(SUSE42\.3)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "42.3", release); if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); flag = 0; if ( rpm_check(release:"SUSE42.3", reference:"python-Django-1.8.19-6.4.1") ) flag++; if (flag) { if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get()); else security_hole(0); exit(0); } else { tested = pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "python-Django"); }

Redhat

advisories

rhsa
id RHSA-2017:1445
rhsa
id RHSA-2017:1451
rhsa
id RHSA-2017:1462
rhsa
id RHSA-2017:1470
rhsa
id RHSA-2017:1596
rhsa
id RHSA-2017:3093
rhsa
id RHSA-2018:2927

rpms

python-django-0:1.6.11-7.el7ost
python-django-bash-completion-0:1.6.11-7.el7ost
python-django-doc-0:1.6.11-7.el7ost
python-django-0:1.8.18-1.el7ost
python-django-bash-completion-0:1.8.18-1.el7ost
python-django-doc-0:1.8.18-1.el7ost
python-django-0:1.8.18-1.el7ost
python-django-bash-completion-0:1.8.18-1.el7ost
python-django-0:1.8.18-1.el7ost
python-django-bash-completion-0:1.8.18-1.el7ost
python-django-0:1.8.18-1.el7ost
python-django-bash-completion-0:1.8.18-1.el7ost
python-django-0:1.8.18-1.el7ost
python-django-bash-completion-0:1.8.18-1.el7ost
SOAPpy-0:0.11.6-17.el7
ansiblerole-insights-client-0:1.5-1.el7sat
candlepin-0:2.4.8-1.el7
candlepin-selinux-0:2.4.8-1.el7
createrepo_c-0:0.7.4-1.el7sat
createrepo_c-debuginfo-0:0.7.4-1.el7sat
createrepo_c-libs-0:0.7.4-1.el7sat
foreman-0:1.18.0.37-1.el7sat
foreman-bootloaders-redhat-0:201801241201-3.el7sat
foreman-bootloaders-redhat-tftpboot-0:201801241201-3.el7sat
foreman-cli-0:1.18.0.37-1.el7sat
foreman-compute-0:1.18.0.37-1.el7sat
foreman-debug-0:1.18.0.37-1.el7sat
foreman-ec2-0:1.18.0.37-1.el7sat
foreman-gce-0:1.18.0.37-1.el7sat
foreman-installer-1:1.18.0.2-1.el7sat
foreman-installer-katello-0:3.7.0.10-1.el7sat
foreman-journald-0:1.18.0.37-1.el7sat
foreman-libvirt-0:1.18.0.37-1.el7sat
foreman-openstack-0:1.18.0.37-1.el7sat
foreman-ovirt-0:1.18.0.37-1.el7sat
foreman-postgresql-0:1.18.0.37-1.el7sat
foreman-proxy-0:1.18.0.1-1.el7sat
foreman-proxy-content-0:3.7.0-8.el7sat
foreman-rackspace-0:1.18.0.37-1.el7sat
foreman-selinux-0:1.18.0.1-1.el7sat
foreman-telemetry-0:1.18.0.37-1.el7sat
foreman-vmware-0:1.18.0.37-1.el7sat
hfsplus-tools-0:332.14-12.el7
hfsplus-tools-debuginfo-0:332.14-12.el7
katello-0:3.7.0-8.el7sat
katello-certs-tools-0:2.4.0-2.el7sat
katello-client-bootstrap-0:1.6.0-1.el7sat
katello-common-0:3.7.0-8.el7sat
katello-debug-0:3.7.0-8.el7sat
katello-installer-base-0:3.7.0.10-1.el7sat
katello-selinux-0:3.0.3-2.el7sat
katello-service-0:3.7.0-8.el7sat
kobo-0:0.5.1-1.el7sat
libstemmer-0:0-2.585svn.el7sat
libstemmer-debuginfo-0:0-2.585svn.el7sat
libwebsockets-0:2.1.0-3.el7
libwebsockets-debuginfo-0:2.1.0-3.el7
liquibase-0:3.1.0-1.el7
livecd-tools-1:20.4-1.6.el7sat
mod_passenger-0:4.0.18-24.el7sat
mod_xsendfile-0:0.12-10.el7sat
mod_xsendfile-debuginfo-0:0.12-10.el7sat
mongodb-0:2.6.11-2.el7sat
mongodb-debuginfo-0:2.6.11-2.el7sat
mongodb-server-0:2.6.11-2.el7sat
ostree-0:2017.1-2.atomic.el7
ostree-debuginfo-0:2017.1-2.atomic.el7
pcp-mmvstatsd-0:0.4-1.el7sat
pulp-admin-client-0:2.16.4.1-1.el7sat
pulp-docker-admin-extensions-0:3.1.4.1-1.el7sat
pulp-docker-plugins-0:3.1.4.1-1.el7sat
pulp-katello-0:1.0.2-5.el7sat
pulp-maintenance-0:2.16.4.1-1.el7sat
pulp-nodes-child-0:2.16.4.1-1.el7sat
pulp-nodes-common-0:2.16.4.1-1.el7sat
pulp-nodes-parent-0:2.16.4.1-1.el7sat
pulp-ostree-admin-extensions-0:1.3.0-1.el7sat
pulp-ostree-plugins-0:1.3.0-1.el7sat
pulp-puppet-admin-extensions-0:2.16.4-3.el7sat
pulp-puppet-plugins-0:2.16.4-3.el7sat
pulp-puppet-tools-0:2.16.4-3.el7sat
pulp-rpm-admin-extensions-0:2.16.4.1-5.el7sat
pulp-rpm-plugins-0:2.16.4.1-5.el7sat
pulp-selinux-0:2.16.4.1-1.el7sat
pulp-server-0:2.16.4.1-1.el7sat
puppet-agent-0:5.5.0-2.el7sat
puppet-agent-oauth-0:0.5.1-3.el7sat
puppet-foreman_scap_client-0:0.3.16-3.el7sat
puppetlabs-stdlib-0:4.2.1-1.20140510git08b00d9.el7sat
puppetserver-0:5.3.1-1.el7sat
python-anyjson-0:0.3.3-5.el7sat
python-billiard-debuginfo-1:3.5.0.3-3.el7sat
python-blinker-0:1.3-2.el7sat
python-bson-0:3.2-1.el7sat
python-crane-0:3.1.1-1.el7sat
python-flask-1:0.10.1-4.el7sat
python-fpconst-0:0.7.3-12.el7
python-gnupg-0:0.3.7-1.el7ui
python-gofer-0:2.12.1-1.el7sat
python-gofer-qpid-0:2.12.1-1.el7sat
python-imgcreate-1:20.4-1.6.el7sat
python-isodate-0:0.5.0-5.pulp.el7sat
python-itsdangerous-0:0.23-1.el7sat
python-jinja2-0:2.7.2-2.el7sat
python-kid-0:0.9.6-11.el7sat
python-mongoengine-0:0.10.5-2.el7sat
python-nectar-0:1.5.6-1.el7sat
python-oauth2-0:1.5.211-8.el7sat
python-okaara-0:1.0.32-1.el7sat
python-pulp-agent-lib-0:2.16.4.1-1.el7sat
python-pulp-bindings-0:2.16.4.1-1.el7sat
python-pulp-client-lib-0:2.16.4.1-1.el7sat
python-pulp-common-0:2.16.4.1-1.el7sat
python-pulp-docker-common-0:3.1.4.1-1.el7sat
python-pulp-integrity-0:2.16.4.1-5.el7sat
python-pulp-oid_validation-0:2.16.4.1-1.el7sat
python-pulp-ostree-common-0:1.3.0-1.el7sat
python-pulp-puppet-common-0:2.16.4-3.el7sat
python-pulp-repoauth-0:2.16.4.1-1.el7sat
python-pulp-rpm-common-0:2.16.4.1-5.el7sat
python-pulp-streamer-0:2.16.4.1-1.el7sat
python-pymongo-0:3.2-1.el7sat
python-pymongo-debuginfo-0:3.2-1.el7sat
python-pymongo-gridfs-0:3.2-1.el7sat
python-qpid-0:1.35.0-5.el7
python-qpid-proton-0:0.16.0-12.el7sat
python-qpid-qmf-0:1.36.0-19.el7
python-saslwrapper-0:0.22-5.el7sat
python-semantic_version-0:2.2.0-6.el7sat
python-simplejson-0:3.2.0-1.el7sat
python-simplejson-debuginfo-0:3.2.0-1.el7sat
python-twisted-core-0:12.2.0-4.el7
python-twisted-core-debuginfo-0:12.2.0-4.el7
python-twisted-web-0:12.1.0-5.el7_2
python-werkzeug-0:0.9.1-1.el7sat
python-zope-interface-0:4.0.5-4.el7
python-zope-interface-debuginfo-0:4.0.5-4.el7
python2-amqp-0:2.2.2-3.el7sat
python2-billiard-1:3.5.0.3-3.el7sat
python2-celery-0:4.0.2-4.el7sat
python2-django-0:1.11.11-1.el7sat
python2-kombu-1:4.0.2-8.el7sat
python2-vine-0:1.1.3-4.el7sat
qpid-cpp-client-0:1.36.0-19.el7
qpid-cpp-client-devel-0:1.36.0-19.el7
qpid-cpp-debuginfo-0:1.36.0-19.el7
qpid-cpp-server-0:1.36.0-19.el7
qpid-cpp-server-linearstore-0:1.36.0-19.el7
qpid-dispatch-debuginfo-0:0.8.0-19.el7
qpid-dispatch-router-0:0.8.0-19.el7
qpid-dispatch-tools-0:0.8.0-19.el7
qpid-proton-c-0:0.16.0-12.el7sat
qpid-proton-debuginfo-0:0.16.0-12.el7sat
qpid-qmf-0:1.36.0-19.el7
qpid-tools-0:1.36.0-19.el7
redhat-access-insights-puppet-0:0.0.9-3.el7sat
repoview-0:0.6.6-4.el7sat
rubygem-ansi-0:1.4.3-3.el7sat
rubygem-bundler_ext-0:0.4.1-3.el7sat
rubygem-clamp-0:1.1.2-2.el7sat
rubygem-concurrent-ruby-1:1.0.3-6.el7sat
rubygem-facter-0:2.4.1-2.el7sat
rubygem-fast_gettext-0:1.1.0-4.el7sat
rubygem-ffi-0:1.4.0-3.el7sat
rubygem-ffi-debuginfo-0:1.4.0-3.el7sat
rubygem-foreman_scap_client-0:0.3.0-3.el7sat
rubygem-gssapi-0:1.1.2-4.el7sat
rubygem-hashie-0:2.0.5-5.el7sat
rubygem-highline-0:1.7.8-3.el7sat
rubygem-kafo-0:2.1.0-1.el7sat
rubygem-kafo_parsers-0:0.1.6-1.el7sat
rubygem-kafo_wizards-0:0.0.1-2.el7sat
rubygem-little-plugger-0:1.1.3-22.el7sat
rubygem-logging-0:2.2.2-1.el7sat
rubygem-mime-types-0:1.19-7.el7sat
rubygem-multi_json-0:1.12.2-2.el7sat
rubygem-netrc-0:0.7.7-9.el7sat
rubygem-newt-0:0.9.6-3.el7sat
rubygem-newt-debuginfo-0:0.9.6-3.el7sat
rubygem-oauth-0:0.5.4-2.el7sat
rubygem-openscap-0:0.4.7-3.el7sat
rubygem-passenger-0:4.0.18-24.el7sat
rubygem-passenger-debuginfo-0:4.0.18-24.el7sat
rubygem-passenger-native-0:4.0.18-24.el7sat
rubygem-passenger-native-libs-0:4.0.18-24.el7sat
rubygem-powerbar-0:1.0.17-2.el7sat
rubygem-rack-1:1.6.4-3.el7sat
rubygem-rack-protection-0:1.5.3-4.el7sat
rubygem-rake-0:0.9.2.2-41.el7sat
rubygem-rb-inotify-0:0.9.7-4.el7sat
rubygem-rest-client-0:1.6.7-7.el7sat
rubygem-rkerberos-0:0.1.3-5.el7sat
rubygem-rkerberos-debuginfo-0:0.1.3-5.el7sat
rubygem-rsec-0:0.4.2-2.el7sat
rubygem-rubyipmi-0:0.10.0-2.el7sat
rubygem-sinatra-1:1.4.7-3.el7sat
rubygem-smart_proxy_ansible-0:2.0.2-3.el7sat
rubygem-smart_proxy_dhcp_remote_isc-0:0.0.4-1.el7sat
rubygem-smart_proxy_discovery-0:1.0.4-1.el7sat
rubygem-smart_proxy_discovery_image-0:1.0.9-2.el7sat
rubygem-smart_proxy_dynflow-0:0.2.1-2.el7sat
rubygem-smart_proxy_openscap-0:0.6.11-1.el7sat
rubygem-smart_proxy_pulp-0:1.3.0-1.el7sat
rubygem-smart_proxy_remote_execution_ssh-0:0.2.0-3.el7sat
rubygem-tilt-0:1.3.7-2.git.0.3b416c9.el7sat
saslwrapper-0:0.22-5.el7sat
saslwrapper-debuginfo-0:0.22-5.el7sat
satellite-0:6.4.0-15.el7sat
satellite-capsule-0:6.4.0-15.el7sat
satellite-cli-0:6.4.0-15.el7sat
satellite-common-0:6.4.0-15.el7sat
satellite-debug-tools-0:6.4.0-15.el7sat
satellite-installer-0:6.4.0.7-2.el7sat
tfm-ror51-rubygem-actioncable-0:5.1.6-1.el7sat
tfm-ror51-rubygem-actionmailer-0:5.1.6-1.el7sat
tfm-ror51-rubygem-actionpack-0:5.1.6-1.el7sat
tfm-ror51-rubygem-actionview-0:5.1.6-1.el7sat
tfm-ror51-rubygem-activejob-0:5.1.6-1.el7sat
tfm-ror51-rubygem-activemodel-0:5.1.6-1.el7sat
tfm-ror51-rubygem-activerecord-0:5.1.6-1.el7sat
tfm-ror51-rubygem-activesupport-0:5.1.6-1.el7sat
tfm-ror51-rubygem-arel-0:8.0.0-1.el7sat
tfm-ror51-rubygem-builder-0:3.2.3-1.el7sat
tfm-ror51-rubygem-coffee-rails-0:4.2.2-1.el7sat
tfm-ror51-rubygem-coffee-script-0:2.4.1-1.el7sat
tfm-ror51-rubygem-coffee-script-source-0:1.12.2-1.el7sat
tfm-ror51-rubygem-concurrent-ruby-0:1.0.5-4.el7sat
tfm-ror51-rubygem-crass-0:1.0.2-1.el7sat
tfm-ror51-rubygem-erubi-0:1.7.0-1.el7sat
tfm-ror51-rubygem-execjs-0:2.7.0-1.el7sat
tfm-ror51-rubygem-globalid-0:0.4.1-1.el7sat
tfm-ror51-rubygem-i18n-0:0.9.1-2.el7sat
tfm-ror51-rubygem-loofah-0:2.1.1-2.el7sat
tfm-ror51-rubygem-mail-0:2.7.0-2.el7sat
tfm-ror51-rubygem-method_source-0:0.9.0-1.el7sat
tfm-ror51-rubygem-mime-types-0:3.1-1.el7sat
tfm-ror51-rubygem-mime-types-data-0:3.2016.0521-1.el7sat
tfm-ror51-rubygem-mini_mime-0:1.0.0-1.el7sat
tfm-ror51-rubygem-multi_json-0:1.12.2-1.el7sat
tfm-ror51-rubygem-mustermann-0:1.0.1-1.el7sat
tfm-ror51-rubygem-nio4r-0:2.1.0-1.el7sat
tfm-ror51-rubygem-nio4r-debuginfo-0:2.1.0-1.el7sat
tfm-ror51-rubygem-nokogiri-0:1.8.1-1.el7sat
tfm-ror51-rubygem-nokogiri-debuginfo-0:1.8.1-1.el7sat
tfm-ror51-rubygem-rack-0:2.0.3-1.el7sat
tfm-ror51-rubygem-rack-protection-0:2.0.0-1.el7sat
tfm-ror51-rubygem-rack-test-0:0.7.0-1.el7sat
tfm-ror51-rubygem-rails-0:5.1.6-1.el7sat
tfm-ror51-rubygem-rails-dom-testing-0:2.0.3-1.el7sat
tfm-ror51-rubygem-rails-html-sanitizer-0:1.0.3-2.el7sat
tfm-ror51-rubygem-railties-0:5.1.6-1.el7sat
tfm-ror51-rubygem-sinatra-0:2.0.0-1.el7sat
tfm-ror51-rubygem-sprockets-0:3.7.1-1.el7sat
tfm-ror51-rubygem-sprockets-rails-0:3.2.1-1.el7sat
tfm-ror51-rubygem-sqlite3-0:1.3.13-1.el7sat
tfm-ror51-rubygem-sqlite3-debuginfo-0:1.3.13-1.el7sat
tfm-ror51-rubygem-thor-0:0.20.0-1.el7sat
tfm-ror51-rubygem-thread_safe-0:0.3.6-1.el7sat
tfm-ror51-rubygem-tilt-0:2.0.8-1.el7sat
tfm-ror51-rubygem-turbolinks-0:2.5.4-1.el7sat
tfm-ror51-rubygem-tzinfo-0:1.2.4-2.el7sat
tfm-ror51-rubygem-websocket-driver-0:0.6.5-2.el7sat
tfm-ror51-rubygem-websocket-driver-debuginfo-0:0.6.5-2.el7sat
tfm-ror51-rubygem-websocket-extensions-0:0.1.2-1.el7sat
tfm-ror51-runtime-0:1.1-2.el7sat
tfm-rubygem-activerecord-session_store-0:1.1.0-6.el7sat
tfm-rubygem-addressable-0:2.3.6-5.el7sat
tfm-rubygem-algebrick-0:0.7.3-5.el7sat
tfm-rubygem-ancestry-0:3.0.0-2.el7sat
tfm-rubygem-anemone-0:0.7.2-19.el7sat
tfm-rubygem-angular-rails-templates-1:1.0.2-2.el7sat
tfm-rubygem-apipie-bindings-0:0.2.2-1.el7sat
tfm-rubygem-apipie-params-0:0.0.5-4.el7sat
tfm-rubygem-apipie-rails-0:0.5.7-1.el7sat
tfm-rubygem-audited-0:4.7.0-1.el7sat
tfm-rubygem-autoparse-0:0.3.3-9.el7sat
tfm-rubygem-awesome_print-0:1.8.0-2.el7sat
tfm-rubygem-bastion-0:6.1.11-1.el7sat
tfm-rubygem-bundler_ext-0:0.4.1-3.el7sat
tfm-rubygem-clamp-0:1.1.2-2.el7sat
tfm-rubygem-concurrent-ruby-edge-1:0.2.4-1.el7sat
tfm-rubygem-css_parser-0:1.4.7-2.el7sat
tfm-rubygem-daemons-0:1.2.3-6.el7sat
tfm-rubygem-deacon-0:1.0.0-3.el7sat
tfm-rubygem-deep_cloneable-0:2.2.2-2.el7sat
tfm-rubygem-deface-0:1.2.0-10.el7sat
tfm-rubygem-diffy-0:3.0.1-5.el7sat
tfm-rubygem-docker-api-0:1.28.0-3.el7sat
tfm-rubygem-domain_name-0:0.5.20160310-3.el7sat
tfm-rubygem-dynflow-0:1.0.5.1-1.el7sat
tfm-rubygem-excon-0:0.58.0-2.el7sat
tfm-rubygem-extlib-0:0.9.16-5.el7sat
tfm-rubygem-facter-0:2.4.0-5.el7sat
tfm-rubygem-faraday-0:0.9.1-5.el7sat
tfm-rubygem-fast_gettext-0:1.4.1-2.el7sat
tfm-rubygem-ffi-0:1.4.0-11.el7sat
tfm-rubygem-ffi-debuginfo-0:1.4.0-11.el7sat
tfm-rubygem-fog-0:1.42.1-1.el7sat
tfm-rubygem-fog-aws-0:1.3.0-2.el7sat
tfm-rubygem-fog-core-0:1.45.0-2.el7sat
tfm-rubygem-fog-digitalocean-0:0.3.0-2.el7sat
tfm-rubygem-fog-google-0:0.1.0-4.el7sat
tfm-rubygem-fog-json-0:1.0.2-9.el7sat
tfm-rubygem-fog-libvirt-0:0.4.1-2.el7sat
tfm-rubygem-fog-openstack-0:0.1.25-2.el7sat
tfm-rubygem-fog-ovirt-0:1.1.2-1.el7sat
tfm-rubygem-fog-rackspace-0:0.1.4-2.el7sat
tfm-rubygem-fog-vsphere-0:2.3.0-1.el7sat
tfm-rubygem-fog-xenserver-0:0.2.3-3.el7sat
tfm-rubygem-fog-xml-0:0.1.2-6.el7sat
tfm-rubygem-foreman-redhat_access-0:2.0.13-1.el7sat
tfm-rubygem-foreman-tasks-0:0.13.4.2-1.el7sat
tfm-rubygem-foreman-tasks-core-0:0.2.5-1.el7sat
tfm-rubygem-foreman_ansible-0:2.2.9-2.el7sat
tfm-rubygem-foreman_ansible_core-0:2.1.1-1.el7sat
tfm-rubygem-foreman_bootdisk-0:12.0.0-1.el7sat
tfm-rubygem-foreman_discovery-0:12.0.2.1-1.el7sat
tfm-rubygem-foreman_docker-0:4.1.0-1.el7sat
tfm-rubygem-foreman_hooks-0:0.3.14.1-1.el7sat
tfm-rubygem-foreman_openscap-0:0.10.3-1.el7sat
tfm-rubygem-foreman_remote_execution-0:1.5.6-4.el7sat
tfm-rubygem-foreman_remote_execution_core-0:1.1.3-1.el7sat
tfm-rubygem-foreman_templates-0:6.0.3-1.el7sat
tfm-rubygem-foreman_theme_satellite-0:2.0.1.11-1.el7sat
tfm-rubygem-foreman_virt_who_configure-0:0.2.2-1.el7sat
tfm-rubygem-formatador-0:0.2.1-10.el7sat
tfm-rubygem-friendly_id-0:5.1.0-4.el7sat
tfm-rubygem-get_process_mem-0:0.2.1-2.el7sat
tfm-rubygem-gettext_i18n_rails-0:1.2.1-4.el7sat
tfm-rubygem-git-0:1.2.5-8.el7sat
tfm-rubygem-google-api-client-0:0.8.2-10.el7sat
tfm-rubygem-gssapi-0:1.2.0-4.el7sat
tfm-rubygem-hammer_cli-0:0.13.1-1.el7sat
tfm-rubygem-hammer_cli_csv-0:2.3.1-2.el7sat
tfm-rubygem-hammer_cli_foreman-0:0.13.2.1-1.el7sat
tfm-rubygem-hammer_cli_foreman_admin-0:0.0.8-2.el7sat
tfm-rubygem-hammer_cli_foreman_ansible-0:0.1.1-1.el7sat
tfm-rubygem-hammer_cli_foreman_bootdisk-0:0.1.3.3-3.el7sat
tfm-rubygem-hammer_cli_foreman_discovery-0:1.0.0-2.el7sat
tfm-rubygem-hammer_cli_foreman_docker-0:0.0.6-3.el7sat
tfm-rubygem-hammer_cli_foreman_openscap-0:0.1.6-1.el7sat
tfm-rubygem-hammer_cli_foreman_remote_execution-0:0.1.0-1.el7sat
tfm-rubygem-hammer_cli_foreman_tasks-0:0.0.12-2.el7sat
tfm-rubygem-hammer_cli_foreman_templates-0:0.1.0-1.el7sat
tfm-rubygem-hammer_cli_foreman_virt_who_configure-0:0.0.3-2.el7sat
tfm-rubygem-hammer_cli_katello-0:0.13.4.3-1.el7sat
tfm-rubygem-hashie-0:2.0.5-5.el7sat
tfm-rubygem-highline-0:1.7.8-3.el7sat
tfm-rubygem-http-cookie-0:1.0.2-4.el7sat
tfm-rubygem-ipaddress-0:0.8.0-10.el7sat
tfm-rubygem-jgrep-0:1.3.3-11.el7sat
tfm-rubygem-journald-logger-0:2.0.3-1.el7sat
tfm-rubygem-journald-native-0:1.0.10-1.el7sat
tfm-rubygem-journald-native-debuginfo-0:1.0.10-1.el7sat
tfm-rubygem-jwt-0:1.2.0-5.el7sat
tfm-rubygem-katello-0:3.7.0.41-1.el7sat
tfm-rubygem-launchy-0:2.4.3-5.el7sat
tfm-rubygem-ldap_fluff-0:0.4.7-2.el7sat
tfm-rubygem-little-plugger-0:1.1.3-22.el7sat
tfm-rubygem-locale-0:2.0.9-12.el7sat
tfm-rubygem-logging-0:2.2.2-4.el7sat
tfm-rubygem-logging-journald-0:1.0.0-1.el7sat
tfm-rubygem-multipart-post-0:1.2.0-5.el7sat
tfm-rubygem-net-ldap-0:0.15.0-2.el7sat
tfm-rubygem-net-ping-0:2.0.1-2.el7sat
tfm-rubygem-net-scp-0:1.2.1-2.el7sat
tfm-rubygem-net-ssh-0:4.0.1-4.el7sat
tfm-rubygem-net-ssh-krb-0:0.4.0-2.el7sat
tfm-rubygem-netrc-0:0.11.0-2.el7sat
tfm-rubygem-oauth-0:0.5.4-2.el7sat
tfm-rubygem-ovirt-engine-sdk-0:4.2.3-1.el7sat
tfm-rubygem-ovirt-engine-sdk-debuginfo-0:4.2.3-1.el7sat
tfm-rubygem-ovirt_provision_plugin-0:1.0.2-2.el7sat
tfm-rubygem-parse-cron-0:0.1.4-3.el7sat
tfm-rubygem-passenger-0:4.0.18-24.el7sat
tfm-rubygem-passenger-debuginfo-0:4.0.18-24.el7sat
tfm-rubygem-passenger-native-0:4.0.18-24.el7sat
tfm-rubygem-passenger-native-libs-0:4.0.18-24.el7sat
tfm-rubygem-pg-0:0.21.0-2.el7sat
tfm-rubygem-pg-debuginfo-0:0.21.0-2.el7sat
tfm-rubygem-polyglot-0:0.3.5-2.el7sat
tfm-rubygem-powerbar-0:1.0.17-2.el7sat
tfm-rubygem-prometheus-client-0:0.7.1-1.el7sat
tfm-rubygem-qpid_messaging-0:1.36.0-2.el7sat
tfm-rubygem-qpid_messaging-debuginfo-0:1.36.0-2.el7sat
tfm-rubygem-quantile-0:0.2.0-1.el7sat
tfm-rubygem-rabl-0:0.13.1-1.el7sat
tfm-rubygem-rack-jsonp-0:1.3.1-6.el7sat
tfm-rubygem-rails-i18n-0:5.0.4-1.el7sat
tfm-rubygem-rainbow-0:2.2.1-4.el7sat
tfm-rubygem-rbovirt-0:0.1.7-1.el7sat
tfm-rubygem-rbvmomi-0:1.10.0-2.el7sat
tfm-rubygem-record_tag_helper-0:1.0.0-1.el7sat
tfm-rubygem-redhat_access-0:2.1.6-2.el7sat
tfm-rubygem-redhat_access_lib-0:1.1.4-2.el7sat
tfm-rubygem-responders-0:2.4.0-1.el7sat
tfm-rubygem-rest-client-0:2.0.1-2.el7sat
tfm-rubygem-retriable-0:1.4.1-5.el7sat
tfm-rubygem-roadie-0:3.2.2-1.el7sat
tfm-rubygem-roadie-rails-0:1.2.1-1.el7sat
tfm-rubygem-robotex-0:1.0.0-20.el7sat
tfm-rubygem-ruby-libvirt-0:0.7.0-3.el7sat
tfm-rubygem-ruby-libvirt-debuginfo-0:0.7.0-3.el7sat
tfm-rubygem-ruby2ruby-0:2.4.0-1.el7sat
tfm-rubygem-ruby_parser-0:3.10.1-1.el7sat
tfm-rubygem-runcible-0:2.8.1-1.el7sat
tfm-rubygem-safemode-0:1.3.5-1.el7sat
tfm-rubygem-scoped_search-0:4.1.3-1.el7sat
tfm-rubygem-secure_headers-0:5.0.5-1.el7sat
tfm-rubygem-sequel-0:5.7.1-1.el7sat
tfm-rubygem-sexp_processor-0:4.10.0-4.el7sat
tfm-rubygem-signet-0:0.6.0-9.el7sat
tfm-rubygem-smart_proxy_dynflow_core-0:0.2.1-2.el7sat
tfm-rubygem-sshkey-0:1.9.0-2.el7sat
tfm-rubygem-statsd-instrument-0:2.1.4-1.el7sat
tfm-rubygem-trollop-0:2.1.2-2.el7sat
tfm-rubygem-unf-0:0.1.3-6.el7sat
tfm-rubygem-unf_ext-0:0.0.6-8.el7sat
tfm-rubygem-unf_ext-debuginfo-0:0.0.6-8.el7sat
tfm-rubygem-unicode-0:0.4.4.1-5.el7sat
tfm-rubygem-unicode-debuginfo-0:0.4.4.1-5.el7sat
tfm-rubygem-unicode-display_width-0:1.0.5-4.el7sat
tfm-rubygem-useragent-0:0.16.8-2.el7sat
tfm-rubygem-validates_lengths_from_database-0:0.5.0-4.el7sat
tfm-rubygem-webpack-rails-0:0.9.8-4.el7sat
tfm-rubygem-wicked-0:1.3.2-1.el7sat
tfm-rubygem-will_paginate-0:3.1.5-2.el7sat
tfm-rubygem-x-editable-rails-0:1.5.5-3.el7sat
tfm-runtime-0:4.0-3.el7sat
v8-1:3.14.5.10-19.el7sat
v8-debuginfo-1:3.14.5.10-19.el7sat
yaml-cpp-0:0.5.1-7.el7sat
yaml-cpp-debuginfo-0:0.5.1-7.el7sat

Seebug

bulletinFamily	exploit
description	Source: [same thread safety Emergency Response Center](<https://mp.weixin.qq.com/s?__biz=MzI4MzI4MDg1NA==&mid=2247483817&idx=1&sn=5a1fd58b65edf4b88d2f455a486b97bd>) Author: Nearg1e@YSRC Foreign security researcher roks0n provided to the Django official of a vulnerability. #### On is_safe_url function Django comes with a function: `django. utils. http. is_safe_url(url, host=None, allowed_hosts=None, require_https=False) `for filtering the need for the jump of the url. If the url is safe then return ture, insecurity, false is returned. The document is as follows: ``python print(is_safe_url.doc) Return `True ` if the url is a safe redirection (i.e. it doesn't point to a different host and uses a safe scheme). Always returns `False ` on an empty url. If `require_https ` is `True`, only 'https' will be considered a valid scheme, as opposed to 'http' and 'https' with the default, `False`. `` Let's look at the conventional of the several usages: ``python from django. utils. http import is_safe_url In [2]: is_safe_url('http://baidu.com') Out[2]: False In [3]: is_safe_url('baidu.com') Out[3]: True In [5]: is_safe_url('aaaaa') Out[5]: True In [8]: is_safe_url('//blog.neargle.com') Out[8]: False In [7]: is_safe_url('http://google.com/adadadadad','blog.neargle.com') Out[7]: False In [13]: is_safe_url('http://blog.neargle.com/aaaa/bbb', 'blog.neargle.com') Out[13]: True `` Visible in the absence of the designated second parameter of the host case,the url if the non-relative path, i.e., the `HttpResponseRedirect `function will jump to another site, the is_safe_url it is determined that it is unsafe url,if you specify a host as `blog.neargle.com `then `is_safe_url `will determine whether the url belongs to the’blog.neargle.com’if the url is’blog.neargle.com’or the relative path of the url, it is determined that the url is safe. #### urllib. parse. urlparse special case The problem lies in the function of the domain name and the method of determination is based on `urllib. parse. urlparse` Of,the source code is as follows(the `django/utils/http.py`): `python def _is_safe_url(url, host): if url. startswith('///'): return False url_info = urlparse(url) if not url_info. netloc and url_info. scheme: return False if unicodedata. category(url[0])[0] == 'C': return False return ((not url_info. netloc or url_info. netloc == host) and (not url_info. scheme or url_info. the scheme in ['http', 'https']))` We take a look at the urlparse conventional usage and several urlparse unable to handle the special case. ``python > > > urlparse('http://blog.neargle.com/2017/01/09/chrome-ext-spider-for-probe/') ParseResult(scheme='http', netloc='blog.neargle.com', path='/2017/01/09/ chrome-ext-spider-for-probe/', params=", query=", fragment=") >>> >>> urlparse('ftp:99999999') ParseResult(scheme=", netloc=", path='ftp:99999999', params=", query=", fragment=") >>> >>> urlparse('http:99999999') ParseResult(scheme='http', netloc=", path='99999999', params=", query=", fragment=") >>> >>> urlparse('https:99999999') ParseResult(scheme=", netloc=", path='https:99999999', params=", query=", fragment=") >>> >>> urlparse('javascript:222222') ParseResult(scheme=", netloc=", path='javascript:222222', params=", query=", fragment=") >>> >>> urlparse('ftp:aaaaaaa') ParseResult(scheme='ftp', netloc=", path='aaaaaaa', params=", query=", fragment=") >>> >>> urlparse('ftp:127.0.0.1') ParseResult(scheme='ftp', netloc=", path='127.0.0.1', params=", query=", fragment=") >>> >>> urlparse('ftp:127.0.0.1') ParseResult(scheme='ftp', netloc=", path='127.0.0.1', params=", query=", fragment=") `` Can be found when the scheme is not equal to http, and the path is purely digital,urlparse processing, for example, `aaaa:2222222223 `the case is not properly divided, will all return to the path. In this case `url_info. netloc == url_info. scheme == ""`then `((not url_info. netloc or url_info. netloc == host) and (not url_info. scheme or url_info. the scheme in ['http', 'https'])) `is true. Here, incidentally, [django official News&Event ](<https://www.djangoproject.com/weblog/2017/apr/04/security-releases/>)mentioned in the poc:"http:99999999"is unable to bypass, in front of the judge `if not url_info. netloc and url_info. scheme: `it can not.） For example, the following situations: `` > > > is_safe_url('http:555555555') False is_safe_url('ftp:23333333333') True is_safe_url('https:2333333333') True `` #### The use of IP Decimal Bypass is_safe_url But since it is a url jump vulnerability, we need to make a jump to the specified url, https:2333333333这样的url明显是无法访问的 and colon must be followed by pure digital,http:127.0.0.1是无法pypass的 the. What method? In fact, ip is not only the common dotted decimal notation,a decimal number can also represent an ip address,the browser is also supported. For example: `127.0.0.1 == 2130706433, 8.8.8.8 == 134744072 `(Converter:http://www. ipaddressguide. com/ip ),and'http:2130706433'is on the browser can access to the corresponding ip and services, i.e.`'http:2130706433 = http://127.0.0.1/'`the. Here we use `https:1029415385 ` as a poc, this is a google ip,this url can be `bypassis_safe_url ` and jump to google. com. ![](https://images.seebug.org/content/images/2017/04/92B82897-B6E2-47B2-9CA4-0739D87BD002.png) #### Vulnerability validation with the impact We have to write a simple environment: ``python from django. http import HttpResponseRedirect from django. utils. http import is_safe_url def BypassIsUrlSafeCheck(request): url = request. GET. get("url", ") if is_safe_url(url, host="blog.neargle.com"): return HttpResponseRedirect(url) else: return HttpResponseRedirect('/') `` Then visit: `http://127.0.0.1:8000/bypassIsUrlSafeCheck?url=https:1029415385` , as shown in Figure,url被重定向到了google.com the. Not only the developers themselves use `is_safe_url `will be affected, Django by default comes with the admin also use this function to process the next GET \| POST parameters, when the user access`/admin/login/? next=https:1029415385 `log, 登录后同样会跳转到google.com to exit the login is the same used by the function. ``python def _get_login_redirect_url(request, redirect_to): # Ensure the user-originating redirection URL is safe. if not is_safe_url(url=redirect_to, host=request. get_host()): return resolve_url(settings. LOGIN_REDIRECT_URL) return redirect_to @never_cache def login(request, template_name='registration/login.html', redirect_field_name=REDIRECT_FIELD_NAME, authentication_form=AuthenticationForm, extra_context=None, redirect_authenticated_user=False): ...... return HttpResponseRedirect(_get_login_redirect_url(request, redirect_to)) ...... `` ![](https://images.seebug.org/content/images/2017/04/92B82897-B6E2-47B2-9CA4-0739D87BD002-1.png) #### Repair django fix the code yourself refactoring a bit urlparse function,fix the urlparse function of this vulnerability. ``python # Copied from urllib. parse. urlparse() but uses fixed urlsplit() function. def _urlparse(url, scheme=", allow_fragments=True): """Parse a URL into 6 components: :///;?# Return a 6-tuple: (scheme, netloc, path, params, query, fragment). Note that we don't break the components up in smaller bits (e.g. netloc is a single string) and we don't expand % escapes.""" url, scheme, _coerce_result = _coerce_args(url, scheme) splitresult = _urlsplit(url, scheme, allow_fragments) scheme, netloc, url, query, fragment = splitresult if scheme in uses_params and ';' in url: url, params = _splitparams(url) else: params = " result = ParseResult(scheme, netloc, url, params, query, fragment) return _coerce_result(result) `` #### On the official mentioned possible XSS attack django official News&Event mentioned in this vulnerability may produce a XSS, I think unless the programmer to accept a jump to the url inserted into `a<script type="text/javascript" src="{{ url }}"></script>`and other special circumstances, direct use to produce XSS in the scene is still relatively small. If you think of the other scenes also please enlighten me and good it.
id	SSV:92943
last seen	2017-11-19
modified	2017-04-13
published	2017-04-13
reporter	Root
title	Django is_safe_url() the URL to jump to the filter function of the Bypass（CVE-2017-7233）