CVE-2016-9013

Description

Django 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3 use a hardcoded password for a temporary database user created when running tests with an Oracle database, which makes it easier for remote attackers to obtain access to the database server by leveraging failure to manually specify a password in the database settings TEST dictionary.

How to fix CVE-2016-9013

To remediate CVE-2016-9013, upgrade the affected package to a fixed version below.

• —upgrade to 1.8.16-r0 or later
• —upgrade to 1.8.16-r0 or later
• —upgrade to 1:1.10.3-1 or later
• —upgrade to 1.7.11-1+deb8u2 or later
• —upgrade to 1.10.3 or later
• —upgrade to 1.8.16 or later

Is CVE-2016-9013 being exploited?

Moderate — EPSS is 5.1%. Track this CVE but it's not at the top of the prioritisation list.

Affected packages (6)

• from 0, < 1.8.16-r0
• from 0, < 1.8.16-r0
• from 0, < 1:1.10.3-1
• from 0, < 1.7.11-1+deb8u2
• >= 1.10a1, < 1.10.3
• >= 1.8, < 1.8.16, >= 1.9, < 1.9.11, >= 1.10, < 1.10.3

CVSS scores

References (19)

• ADVISORYgithub.com/advisories/GHSA-mv8g-fhh6-6267
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2016-9013
• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2016-9013
• ADVISORYsecurity.alpinelinux.org/vuln/CVE-2016-9013
• ADVISORY