GitHub Advisoryadvisory · PyPI
GHSA-3f2c-jm6v-cr35 Django DNS Rebinding Vulnerability
CRITICAL
Official page ↗
- Aliases
- CVE-2016-9014
- Ecosystem
- PyPI
- Packages
- Django
- Severity
- Critical
- CVSS vector
- CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- Reviewed
- 2023-07-31
Affected packages
• PyPI Django: >= 1.8a1, < 1.8.16 → fixed in 1.8.16
• PyPI Django: >= 1.9a1, < 1.9.11 → fixed in 1.9.11
• PyPI Django: >= 1.10a1, < 1.10.3 → fixed in 1.10.3
Description
Django before 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3, when settings.DEBUG is True, allow remote attackers to conduct DNS rebinding attacks by leveraging failure to validate the HTTP Host header against settings.ALLOWED_HOSTS.
Related
Alias · CVE (1)
- CVE-2016-9014 Django before 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3, when settings.DEBUG is True, allow remote attackers to… vulnerability
References
- https://nvd.nist.gov/vuln/detail/CVE-2016-9014 advisory
- https://github.com/django/django/commit/45acd6d836895a4c36575f48b3fb36a3dae98d19 web
- https://github.com/django/django/commit/884e113838e5a72b4b0ec9e5e87aa480f6aa4472 web
- https://github.com/django/django/commit/c401ae9a7dfb1a94a8a61927ed541d6f93089587 web
- https://github.com/django/django package
- https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2016-18.yaml web
- https://lists.fedoraproject.org/archives/list/[email protected]/message/OG5ROMUPS6C7BXELD3TAUUH7OBYV56WQ web
- https://lists.fedoraproject.org/archives/list/[email protected]/message/QXDKJYHN74BWY3P7AR2UZDVJREQMRE6S web
- https://web.archive.org/web/20210123185619/http://www.securityfocus.com/bid/94068 web
- https://web.archive.org/web/20211204043252/http://www.securitytracker.com/id/1037159 web
- https://www.djangoproject.com/weblog/2016/nov/01/security-releases web
- http://www.debian.org/security/2017/dsa-3835 web
- http://www.ubuntu.com/usn/USN-3115-1 web