CVE-2016-9014

Опубликовано: 09 дек. 2016

Источник: nvd

CVSS3: 8.1

CVSS2: 6.8

EPSS Низкий

Описание

Django before 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3, when settings.DEBUG is True, allow remote attackers to conduct DNS rebinding attacks by leveraging failure to validate the HTTP Host header against settings.ALLOWED_HOSTS.

Ссылки

http://www.debian.org/security/2017/dsa-3835
http://www.securityfocus.com/bid/94068
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1037159
Third Party Advisory
VDB Entry
http://www.ubuntu.com/usn/USN-3115-1
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OG5ROMUPS6C7BXELD3TAUUH7OBYV56WQ/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QXDKJYHN74BWY3P7AR2UZDVJREQMRE6S/
https://www.djangoproject.com/weblog/2016/nov/01/security-releases/
Release Notes
Vendor Advisory
http://www.debian.org/security/2017/dsa-3835
http://www.securityfocus.com/bid/94068
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1037159
Third Party Advisory
VDB Entry
http://www.ubuntu.com/usn/USN-3115-1
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OG5ROMUPS6C7BXELD3TAUUH7OBYV56WQ/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QXDKJYHN74BWY3P7AR2UZDVJREQMRE6S/
https://www.djangoproject.com/weblog/2016/nov/01/security-releases/
Release Notes
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:o:fedoraproject:fedora:24:*:*:*:*:*:*:*

cpe:2.3:o:fedoraproject:fedora:25:*:*:*:*:*:*:*

Конфигурация 2

Одно из

cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:16.10:*:*:*:*:*:*:*

Конфигурация 3

Одно из

cpe:2.3:a:djangoproject:django:1.8:*:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.8.1:*:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.8.2:*:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.8.3:*:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.8.4:*:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.8.5:*:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.8.6:*:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.8.7:*:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.8.8:*:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.8.9:*:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.8.10:*:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.8.11:*:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.8.12:*:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.8.13:*:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.8.14:*:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.8.15:*:*:*:*:*:*:*

Конфигурация 4

Одно из

cpe:2.3:a:djangoproject:django:1.10:*:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.10.1:*:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.10.2:*:*:*:*:*:*:*

Конфигурация 5

Одно из

cpe:2.3:a:djangoproject:django:1.9:*:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.9.1:*:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.9.2:*:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.9.3:*:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.9.4:*:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.9.5:*:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.9.6:*:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.9.7:*:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.9.8:*:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.9.9:*:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.9.10:*:*:*:*:*:*:*

EPSS

Процентиль: 88%

0.04296

Низкий

8.1 High

CVSS3

6.8 Medium

CVSS2

Дефекты

CWE-264

Связанные уязвимости

CVE-2016-9014

CVSS3: 8.1

ubuntu

больше 8 лет назад

CVE-2016-9014

CVSS3: 7.4

redhat

больше 8 лет назад

CVE-2016-9014

CVSS3: 8.1

debian

больше 8 лет назад

Django before 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x bef ...

GHSA-3f2c-jm6v-cr35

CVSS3: 8.1

github

около 3 лет назад

Django DNS Rebinding Vulnerability

openSUSE-SU-2018:0826-1

suse-cvrf

около 7 лет назад

Security update for python-Django

EPSS

Процентиль: 88%

0.04296

Низкий

8.1 High

CVSS3

6.8 Medium

CVSS2

Дефекты

CWE-264