8.1high
CVE-2016-9014
Django DNS Rebinding Vulnerability
Also known as GHSA-3f2c-jm6v-cr35, PYSEC-2016-18
Published 9 y ago · modified 4 mo ago · JSON
CVSS
8.1
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
6.1%
percentile 93%
Public exploits
0
none known
Summary
Django before 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3, when settings.DEBUG is True, allow remote attackers to conduct DNS rebinding attacks by leveraging failure to validate the HTTP Host header against settings.ALLOWED_HOSTS.
Exploit prediction (EPSS)
6.07% probability of exploitation in the next 30 days, higher than 93% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 8.1 | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 6.8 | AV:N/AC:M/Au:N/C:P/I:P/A:P |
| GitHub | 3.0 | 8.1 | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pypi | django | >=1.8a1, <1.8.16 >=1.9a1, <1.9.11 >=1.10a1, <1.10.3 <1.8.16 >=1.9, <1.9.11 >=1.10, <1.10.3 | 1.8.16 1.9.11 1.10.3 |
Classification
- Weakness
- CWE-264 Permissions, Privileges, and Access Controls
- Technology feeds
- Django (RSS, critical only)
References
- djangoproject.com /weblog/2016/nov/01/security-releases/ · x_refsource_CONFIRM, x_transferred
- lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/QXDKJYHN74BWY3P7AR2UZDVJ · vendor-advisory, x_refsource_FEDORA, x_transferred
- securityfocus.com /bid/94068 · vdb-entry, x_refsource_BID, x_transferred
- debian.org /security/2017/dsa-3835 · vendor-advisory, x_refsource_DEBIAN, x_transferred
- ubuntu.com /usn/USN-3115-1 · vendor-advisory, x_refsource_UBUNTU, x_transferred
- securitytracker.com /id/1037159 · vdb-entry, x_refsource_SECTRACK, x_transferred
- lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/OG5ROMUPS6C7BXELD3TAUUH7 · vendor-advisory, x_refsource_FEDORA, x_transferred
- nvd.nist.gov /vuln/detail/CVE-2016-9014 · advisory
- github.com /django/django/commit/45acd6d836895a4c36575f48b3fb36a3dae98d19 · web
- github.com /django/django/commit/884e113838e5a72b4b0ec9e5e87aa480f6aa4472 · web
- github.com /django/django/commit/c401ae9a7dfb1a94a8a61927ed541d6f93089587 · web
- github.com /django/django · package
- github.com /pypa/advisory-database/tree/main/vulns/django/PYSEC-2016-18.yaml · web
- lists.fedoraproject.org /archives/list/package-announce@lists.fedoraproject.org/message/OG5ROMUPS6C7BXELD3TAUUH7OB · web
- lists.fedoraproject.org /archives/list/package-announce@lists.fedoraproject.org/message/QXDKJYHN74BWY3P7AR2UZDVJRE · web
- web.archive.org /web/20210123185619/http://www.securityfocus.com/bid/94068 · web
- web.archive.org /web/20211204043252/http://www.securitytracker.com/id/1037159 · web
- djangoproject.com /weblog/2016/nov/01/security-releases · web
- lists.fedoraproject.org /archives/list/package-announce@lists.fedoraproject.org/message/QXDKJYHN74BWY3P7AR2UZDVJRE · web
- lists.fedoraproject.org /archives/list/package-announce@lists.fedoraproject.org/message/OG5ROMUPS6C7BXELD3TAUUH7OB · web
- github.com /advisories/GHSA-3f2c-jm6v-cr35 · advisory
Sources
- CVE List: CVE-2016-9014
- GitHub Advisory: GHSA-3f2c-jm6v-cr35
- NVD: CVE-2016-9014
- OSV: PYSEC-2016-18
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.