CVE-2016-9014: High severity Fedoraproject Fedora vulnerability
Django before 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3, when settings.DEBUG is True, allow remote attackers to conduct DNS rebinding attacks by leveraging failure to validate the HTTP Host header against settings.ALLOWEDHOSTS.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/Djangoto a version that resolves this vulnerability.Fixed in 1.10.3 - Upgrade
Upgrade
pip/Djangoto a version that resolves this vulnerability.Fixed in 1.9.11 - Upgrade
Upgrade
pip/Djangoto a version that resolves this vulnerability.Fixed in 1.8.16 - Upgrade
Upgrade
alpine/py-djangoto a version that resolves this vulnerability.Fixed in 1.8.16-r0 - Upgrade
Upgrade
alpine/py3-djangoto a version that resolves this vulnerability.Fixed in 1.8.16-r0
Event History
Frequently Asked Questions
What is the severity of CVE-2016-9014?
CVE-2016-9014 is rated as a high-severity vulnerability due to its potential for DNS rebinding attacks.
How do I fix CVE-2016-9014?
To fix CVE-2016-9014, upgrade your Django version to at least 1.8.16, 1.9.11, or 1.10.3.
What does CVE-2016-9014 affect?
CVE-2016-9014 affects Django versions prior to 1.8.16, 1.9.11, and 1.10.3 when the settings.DEBUG is set to True.
Can CVE-2016-9014 be exploited remotely?
Yes, CVE-2016-9014 can be exploited remotely by attackers leveraging the unvalidated HTTP Host header.
What is a DNS rebinding attack as related to CVE-2016-9014?
A DNS rebinding attack allows an attacker to bypass the browser's same-origin policy and interact with services in the local network.