MGASA-2016-0368

See a problem?
Please try reporting it to the source first.
Source
https://advisories.mageia.org/MGASA-2016-0368.html
Import Source
https://advisories.mageia.org/MGASA-2016-0368.json
JSON Data
https://api.osv.dev/v1/vulns/MGASA-2016-0368
Related
Published
2016-11-06T10:34:34Z
Modified
2016-11-06T10:25:02Z
Summary
Updated python-django packages fix security vulnerabilities
Details

User with hardcoded password created when running tests on Oracle When running tests with an Oracle database, Django creates a temporary database user. In older versions, if a password isn't manually specified in the database settings TEST dictionary, a hardcoded password is used. This could allow an attacker with network access to the database server to connect. (CVE-2016-9013)

DNS rebinding vulnerability when DEBUG=True Older versions of Django don't validate the Host header against settings.ALLOWED_HOSTS when settings.DEBUG=True. This makes them vulnerable to a DNS rebinding attack. (CVE-2016-9014)

References
Credits

Affected packages

Mageia:5 / python-django

Package

Name
python-django
Purl
pkg:rpm/mageia/python-django?distro=mageia-5

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.8.16-1.mga5

Ecosystem specific 

{
    "section": "core"
}