CVE-2016-9014
First published: Fri Dec 09 2016(Updated: )
Django before 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3, when settings.DEBUG is True, allow remote attackers to conduct DNS rebinding attacks by leveraging failure to validate the HTTP Host header against settings.ALLOWED_HOSTS.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| pip/Django | >=1.10a1<1.10.3 | 1.10.3 |
| pip/Django | >=1.9a1<1.9.11 | 1.9.11 |
| pip/Django | >=1.8a1<1.8.16 | 1.8.16 |
| Fedora | =24 | |
| Fedora | =25 | |
| Ubuntu | =12.04 | |
| Ubuntu | =14.04 | |
| Ubuntu | =16.04 | |
| Ubuntu | =16.10 | |
| Django | =1.8 | |
| Django | =1.8.1 | |
| Django | =1.8.2 | |
| Django | =1.8.3 | |
| Django | =1.8.4 | |
| Django | =1.8.5 | |
| Django | =1.8.6 | |
| Django | =1.8.7 | |
| Django | =1.8.8 | |
| Django | =1.8.9 | |
| Django | =1.8.10 | |
| Django | =1.8.11 | |
| Django | =1.8.12 | |
| Django | =1.8.13 | |
| Django | =1.8.14 | |
| Django | =1.8.15 | |
| Django | =1.10 | |
| Django | =1.10.1 | |
| Django | =1.10.2 | |
| Django | =1.9 | |
| Django | =1.9.1 | |
| Django | =1.9.2 | |
| Django | =1.9.3 | |
| Django | =1.9.4 | |
| Django | =1.9.5 | |
| Django | =1.9.6 | |
| Django | =1.9.7 | |
| Django | =1.9.8 | |
| Django | =1.9.9 | |
| Django | =1.9.10 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.debian.org/security/2017/dsa-3835
- http://www.securityfocus.com/bid/94068
- http://www.securitytracker.com/id/1037159
- http://www.ubuntu.com/usn/USN-3115-1
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OG5ROMUPS6C7BXELD3TAUUH7OBYV56WQ/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QXDKJYHN74BWY3P7AR2UZDVJREQMRE6S/
- https://www.djangoproject.com/weblog/2016/nov/01/security-releases/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OG5ROMUPS6C7BXELD3TAUUH7OBYV56WQ/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QXDKJYHN74BWY3P7AR2UZDVJREQMRE6S/
- https://nvd.nist.gov/vuln/detail/CVE-2016-9014
- https://web.archive.org/web/20210123185619/http://www.securityfocus.com/bid/94068
- https://web.archive.org/web/20211204043252/http://www.securitytracker.com/id/1037159
- https://github.com/django/django/commit/45acd6d836895a4c36575f48b3fb36a3dae98d19
- https://github.com/django/django/commit/884e113838e5a72b4b0ec9e5e87aa480f6aa4472
- https://github.com/django/django/commit/c401ae9a7dfb1a94a8a61927ed541d6f93089587
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OG5ROMUPS6C7BXELD3TAUUH7OBYV56WQ
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QXDKJYHN74BWY3P7AR2UZDVJREQMRE6S
- https://www.djangoproject.com/weblog/2016/nov/01/security-releases
- https://github.com/advisories/GHSA-3f2c-jm6v-cr35 (Advisory)
- https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2016-18.yaml
Frequently Asked Questions
What is the severity of CVE-2016-9014?
CVE-2016-9014 is rated as a high-severity vulnerability due to its potential for DNS rebinding attacks.
How do I fix CVE-2016-9014?
To fix CVE-2016-9014, upgrade your Django version to at least 1.8.16, 1.9.11, or 1.10.3.
What does CVE-2016-9014 affect?
CVE-2016-9014 affects Django versions prior to 1.8.16, 1.9.11, and 1.10.3 when the settings.DEBUG is set to True.
Can CVE-2016-9014 be exploited remotely?
Yes, CVE-2016-9014 can be exploited remotely by attackers leveraging the unvalidated HTTP Host header.
What is a DNS rebinding attack as related to CVE-2016-9014?
A DNS rebinding attack allows an attacker to bypass the browser's same-origin policy and interact with services in the local network.
- agent/type
- agent/severity
- agent/weakness
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/first-publish-date
- agent/event
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-3f2c-jm6v-cr35
- alias/CVE-2016-9014
- agent/software-canonical-lookup
- agent/references
- agent/last-modified-date
- collector/github-advisory
- agent/trending
- agent/source
- agent/author
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/nvd-cve
- source/NVD
- package-manager/pip
- vendor/fedoraproject
- canonical/fedora
- version/fedora/24
- version/fedora/25
- vendor/canonical
- canonical/ubuntu
- version/ubuntu/12.04
- version/ubuntu/14.04
- version/ubuntu/16.04
- version/ubuntu/16.10
- vendor/djangoproject
- canonical/django
- version/django/1.8
- version/django/1.8.1
- version/django/1.8.2
- version/django/1.8.3
- version/django/1.8.4
- version/django/1.8.5
- version/django/1.8.6
- version/django/1.8.7
- version/django/1.8.8
- version/django/1.8.9
- version/django/1.8.10
- version/django/1.8.11
- version/django/1.8.12
- version/django/1.8.13
- version/django/1.8.14
- version/django/1.8.15
- version/django/1.10
- version/django/1.10.1
- version/django/1.10.2
- version/django/1.9
- version/django/1.9.1
- version/django/1.9.2
- version/django/1.9.3
- version/django/1.9.4
- version/django/1.9.5
- version/django/1.9.6
- version/django/1.9.7
- version/django/1.9.8
- version/django/1.9.9
- version/django/1.9.10