CVE-2016-9013

Description

Django 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3 use a hardcoded password for a temporary database user created when running tests with an Oracle database, which makes it easier for remote attackers to obtain access to the database server by leveraging failure to manually specify a password in the database settings TEST dictionary.

How to fix CVE-2016-9013

To remediate CVE-2016-9013, upgrade the affected package to a fixed version below.

• —upgrade to 1.8.16-r0 or later
• —upgrade to 1.8.16-r0 or later
• —upgrade to 1:1.10.3-1 or later
• —upgrade to 1.7.11-1+deb8u2 or later
• —upgrade to 1.10.3 or later
• —upgrade to 1.8.16 or later

Is CVE-2016-9013 being exploited?

Low — EPSS is 1.2%, meaning exploitation activity has not been observed at scale.

Affected packages (6)

• from 0, < 1.8.16-r0
• from 0, < 1.8.16-r0
• from 0, < 1:1.10.3-1
• from 0, < 1.7.11-1+deb8u2
• >= 1.10a1, < 1.10.3
• >= 1.8, < 1.8.16, >= 1.9, < 1.9.11, >= 1.10, < 1.10.3

CVSS scores

References (19)

• ADVISORYgithub.com/advisories/GHSA-mv8g-fhh6-6267
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2016-9013
• ADVISORYsecurity.alpinelinux.org/vuln/CVE-2016-9013
• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2016-9013
• ADVISORY