CVE-2016-9014: High severity red hat fedora vulnerability
Django before 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3, when settings.DEBUG is True, allow remote attackers to conduct DNS rebinding attacks by leveraging failure to validate the HTTP Host header against settings.ALLOWEDHOSTS.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-9014?
CVE-2016-9014 is rated as a high-severity vulnerability due to its potential for DNS rebinding attacks.
How do I fix CVE-2016-9014?
To fix CVE-2016-9014, upgrade your Django version to at least 1.8.16, 1.9.11, or 1.10.3.
What does CVE-2016-9014 affect?
CVE-2016-9014 affects Django versions prior to 1.8.16, 1.9.11, and 1.10.3 when the settings.DEBUG is set to True.
Can CVE-2016-9014 be exploited remotely?
Yes, CVE-2016-9014 can be exploited remotely by attackers leveraging the unvalidated HTTP Host header.
What is a DNS rebinding attack as related to CVE-2016-9014?
A DNS rebinding attack allows an attacker to bypass the browser's same-origin policy and interact with services in the local network.