Skip to content
Log inStart free trial

GHSA-3f2c-jm6v-cr35 CVE-2016-9014 PYSEC-2016-18

Django DNS Rebinding Vulnerability

High PyPI
Severity
0.0 / 10
High · CVSS 4.0
Exploit chance (EPSS)
6.07%
Chance of exploitation in the next 30 days. Higher than 93.40% of scored vulnerabilities.
Known exploited
No
Not in CISA's catalog
Weakness
—
Not classified
Fix
1.8.16
Upgrade django to this version or later

Description

Django before 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3, when settings.DEBUG is True, allow remote attackers to conduct DNS rebinding attacks by leveraging failure to validate the HTTP Host header against settings.ALLOWED_HOSTS.

Affected versions

PyPI

PackageVulnerableFixed in
django
>= 1.8a1, < 1.8.16
1.8.16
django
>= 1.9a1, < 1.9.11
1.9.11
django
>= 1.10a1, < 1.10.3
1.10.3
django
< 1.8.16
>= 1.9, < 1.9.11
>= 1.10, < 1.10.3
1.8.16
1.9.11
1.10.3

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

django PyPI → 1.8.16

pip
pip install --upgrade "django>=1.8.16"
poetry
poetry add "django>=1.8.16"
uv
uv add "django>=1.8.16"

Severity breakdown

CVSS 4.0 0.0

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Attack vector
Network
Attack complexity
Low
Attack requirements
Present
Privileges required
None
User interaction
None
Confidentiality (vulnerable system)
High
Integrity (vulnerable system)
High
Availability (vulnerable system)
High
Confidentiality (subsequent systems)
None
Integrity (subsequent systems)
None
Availability (subsequent systems)
None

CVSS 3.0 8.1

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack vector
Network
Attack complexity
High
Privileges required
None
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

References

Advisories

Write-ups

Packages

Other links

Timeline

  1. Published
  2. Last updated by the source
  3. Latest EPSS score
AdvisorySeverityWhy it's related
GHSA-q238-5cxm-5c9h
Django GeoDjango vulnerable to denial of service through deeply nested geometry collections
Medium Also affects django
GHSA-wvqv-fj8w-qmhm
Django GeoDjango spatial lookups allow file writes and outbound requests through GDAL raster parsing
High Also affects django
GHSA-8qcx-xf44-272x
Django: DomainNameValidator permits newline characters that may enable HTTP header injection
Medium Also affects django
GHSA-crhf-3pfg-w68w
Django: GDALRaster may over-read heap memory when constructed from bytes
Medium Also affects django
GHSA-3h9f-r86x-qvjx
Django: cache middleware may expose private responses when unrelated request cookies are present
Medium Also affects django
GHSA-8cjm-8mp7-r2xf
Django: UpdateCacheMiddleware may disclose cached responses due to case-sensitive Cache-Control handling
Medium Also affects django
GHSA-mm6v-q8q9-pgcf
Django fails to prevent reuse of a partially-initialized connection after a failed `STARTTLS` handshake
Low Also affects django
GHSA-h7pc-vwp9-298g
Django: signed cookies are vulnerable to salt namespace collisions
Medium Also affects django
Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor