CVE-2016-9013: Critical severity djangoproject Django vulnerability
Django 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3 use a hardcoded password for a temporary database user created when running tests with an Oracle database, which makes it easier for remote attackers to obtain access to the database server by leveraging failure to manually specify a password in the database settings TEST dictionary.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/Djangoto a version that resolves this vulnerability.Fixed in 1.8.16 - Upgrade
Upgrade
pip/Djangoto a version that resolves this vulnerability.Fixed in 1.9.11 - Upgrade
Upgrade
pip/Djangoto a version that resolves this vulnerability.Fixed in 1.10.3 - Upgrade
Upgrade
alpine/py-djangoto a version that resolves this vulnerability.Fixed in 1.8.16-r0 - Upgrade
Upgrade
alpine/py3-djangoto a version that resolves this vulnerability.Fixed in 1.8.16-r0
Event History
Frequently Asked Questions
What is the severity of CVE-2016-9013?
CVE-2016-9013 is considered a moderate severity vulnerability due to the potential for unauthorized database access.
How do I fix CVE-2016-9013?
To fix CVE-2016-9013, upgrade Django to version 1.8.16, 1.9.11, or 1.10.3 or later.
What versions of Django are affected by CVE-2016-9013?
Django versions 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3 are affected by CVE-2016-9013.
What type of attack can exploit CVE-2016-9013?
CVE-2016-9013 can be exploited by remote attackers to gain unauthorized access to the Oracle database.
Is CVE-2016-9013 specific to any database type?
Yes, CVE-2016-9013 specifically involves a vulnerability in Django when used with an Oracle database.