CVE-2016-9014

Опубликовано: 09 дек. 2016

Источник: nvd

CVSS3: 8.1

CVSS2: 6.8

EPSS Низкий

Описание

Django before 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3, when settings.DEBUG is True, allow remote attackers to conduct DNS rebinding attacks by leveraging failure to validate the HTTP Host header against settings.ALLOWED_HOSTS.

Ссылки

http://www.debian.org/security/2017/dsa-3835
http://www.securityfocus.com/bid/94068
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1037159
Third Party Advisory
VDB Entry
http://www.ubuntu.com/usn/USN-3115-1
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OG5ROMUPS6C7BXELD3TAUUH7OBYV56WQ/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QXDKJYHN74BWY3P7AR2UZDVJREQMRE6S/
https://www.djangoproject.com/weblog/2016/nov/01/security-releases/
Release Notes
Vendor Advisory
http://www.debian.org/security/2017/dsa-3835
http://www.securityfocus.com/bid/94068
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1037159
Third Party Advisory
VDB Entry
http://www.ubuntu.com/usn/USN-3115-1
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OG5ROMUPS6C7BXELD3TAUUH7OBYV56WQ/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QXDKJYHN74BWY3P7AR2UZDVJREQMRE6S/
https://www.djangoproject.com/weblog/2016/nov/01/security-releases/
Release Notes
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:o:fedoraproject:fedora:24:*:*:*:*:*:*:*

cpe:2.3:o:fedoraproject:fedora:25:*:*:*:*:*:*:*

Конфигурация 2

Одно из

cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:16.10:*:*:*:*:*:*:*

Конфигурация 3

Одно из

cpe:2.3:a:djangoproject:django:1.8:*:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.8.1:*:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.8.2:*:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.8.3:*:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.8.4:*:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.8.5:*:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.8.6:*:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.8.7:*:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.8.8:*:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.8.9:*:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.8.10:*:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.8.11:*:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.8.12:*:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.8.13:*:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.8.14:*:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.8.15:*:*:*:*:*:*:*

Конфигурация 4

Одно из

cpe:2.3:a:djangoproject:django:1.10:*:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.10.1:*:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.10.2:*:*:*:*:*:*:*

Конфигурация 5

Одно из

cpe:2.3:a:djangoproject:django:1.9:*:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.9.1:*:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.9.2:*:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.9.3:*:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.9.4:*:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.9.5:*:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.9.6:*:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.9.7:*:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.9.8:*:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.9.9:*:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.9.10:*:*:*:*:*:*:*

EPSS

Процентиль: 93%

0.06074

Низкий

8.1 High

CVSS3

6.8 Medium

CVSS2

Дефекты

CWE-264

Связанные уязвимости

CVE-2016-9014

CVSS3: 8.1

ubuntu

почти 10 лет назад

CVE-2016-9014

CVSS3: 7.4

redhat

около 10 лет назад

CVE-2016-9014

CVSS3: 8.1

debian

почти 10 лет назад

Django before 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x bef ...

GHSA-3f2c-jm6v-cr35

CVSS3: 8.1

github

больше 4 лет назад

Django DNS Rebinding Vulnerability

ALT-PU-2017-1227

CVSS3: 9.8

altlinux

больше 9 лет назад

ALT-PU-2017-1227: package `python-module-django` update to version 1.8.17-alt1

EPSS

Процентиль: 93%

0.06074

Низкий

8.1 High

CVSS3

6.8 Medium

CVSS2

Дефекты

CWE-264