CVEvulnerability
CVE-2016-9014
8.1 HIGH
Official page ↗
- Status
- Modified
- Published
- 2016-12-09
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 8.1 HIGH — CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 6.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-264
Description
Django before 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3, when settings.DEBUG is True, allow remote attackers to conduct DNS rebinding attacks by leveraging failure to validate the HTTP Host header against settings.ALLOWED_HOSTS.
Affected configurations
• fedoraproject fedora 24
• fedoraproject fedora 25
• canonical ubuntu linux 12.04
• canonical ubuntu linux 14.04
• canonical ubuntu linux 16.04
• canonical ubuntu linux 16.10
• djangoproject django 1.8
• djangoproject django 1.8.1
• djangoproject django 1.8.2
• djangoproject django 1.8.3
• djangoproject django 1.8.4
• djangoproject django 1.8.5
• djangoproject django 1.8.6
• djangoproject django 1.8.7
• djangoproject django 1.8.8
• djangoproject django 1.8.9
• djangoproject django 1.8.10
• djangoproject django 1.8.11
• djangoproject django 1.8.12
• djangoproject django 1.8.13
• djangoproject django 1.8.14
• djangoproject django 1.8.15
• djangoproject django 1.10
• djangoproject django 1.10.1
• djangoproject django 1.10.2
• djangoproject django 1.9
• djangoproject django 1.9.1
• djangoproject django 1.9.2
• djangoproject django 1.9.3
• djangoproject django 1.9.4
• djangoproject django 1.9.5
• djangoproject django 1.9.6
• djangoproject django 1.9.7
• djangoproject django 1.9.8
• djangoproject django 1.9.9
• djangoproject django 1.9.10
Related
Weakness · not in database (1)
References
- http://www.debian.org/security/2017/dsa-3835 www.debian.org
- http://www.securityfocus.com/bid/94068 Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1037159 Third Party Advisory, VDB Entry
- http://www.ubuntu.com/usn/USN-3115-1 Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OG5ROMUPS6C7BXELD3TAUUH7OBYV56WQ/ lists.fedoraproject.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QXDKJYHN74BWY3P7AR2UZDVJREQMRE6S/ lists.fedoraproject.org
- https://www.djangoproject.com/weblog/2016/nov/01/security-releases/ Release Notes, Vendor Advisory
- http://www.debian.org/security/2017/dsa-3835 www.debian.org
- http://www.securityfocus.com/bid/94068 Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1037159 Third Party Advisory, VDB Entry
- http://www.ubuntu.com/usn/USN-3115-1 Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OG5ROMUPS6C7BXELD3TAUUH7OBYV56WQ/ lists.fedoraproject.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QXDKJYHN74BWY3P7AR2UZDVJREQMRE6S/ lists.fedoraproject.org
- https://www.djangoproject.com/weblog/2016/nov/01/security-releases/ Release Notes, Vendor Advisory