ALT-PU-2017-1227

Критический

ALT-PU-2017-1227: package python-module-django update to version 1.8.17-alt1

Источник

errata.altlinux.org

Дата публикации

01.03.2017

Дата обновления

04.02.2026

Устраненные уязвимости

ALT Linux branch p11

ALT Container

ALT Education

ALT Workstation

ALT Workstation K

ALT Server

ALT Virtualization PVE Edition

ALT Linux branch p10

ALT Server

ALT Virtualization Server

ALT Workstation

ALT Workstation K

ALT Education

Simply Linux

Starterkit

ALT Container

Описание

This update upgrades python-module-django to version 1.8.17-alt1.

Устраненные уязвимости2

CVE-2016-9013

Критический 9.8

Дата публикации: 09.12.2016

CWE-798

Django 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3 use a hardcoded password for a temporary database user created when running tests with an Oracle database, which makes it easier for remote attackers to obtain access to the database server by leveraging failure to manually specify a password in the database settings TEST dictionary.

CVSS 3.0

Критический 9.8

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack vector: Network
Complexity: Low
Privileges: None
User interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High

CVSS 2.0

Высокий 7.5

AV:N/AC:L/Au:N/C:P/I:P/A:P

Access vector: Network
Complexity: Low
Authentication: None
Confidentiality: Partial
Integrity: Partial
Availability: Partial

Ссылки

CVE-2016-9013 https://nvd.nist.gov/vuln/detail/CVE-2016-9013

Ссылки3

ALT-PU-2017-1227 https://errata.altlinux.org/ALT-PU-2017-1227

GHSA-3f2c-jm6v-cr35

https://github.com/advisories/GHSA-3f2c-jm6v-cr35

GHSA-mv8g-fhh6-6267

https://github.com/advisories/GHSA-mv8g-fhh6-6267

Связанные уязвимости

openSUSE-SU-2018:0826-1

suse-cvrf

больше 8 лет назад

Security update for python-Django

openSUSE-SU-2018:0824-1

suse-cvrf

больше 8 лет назад

Security update for python3-Django

CVE-2016-9014

CVSS3: 8.1

ubuntu

почти 10 лет назад

Django before 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3, when settings.DEBUG is True, allow remote attackers to conduct DNS rebinding attacks by leveraging failure to validate the HTTP Host header against settings.ALLOWED_HOSTS.

CVE-2016-9014

CVSS3: 7.4

redhat

около 10 лет назад

CVE-2016-9014

CVSS3: 8.1

nvd

почти 10 лет назад