kritisch
CVE-2016-9013
python-django: user with hardcoded password created when running tests on Oracle
In der Trivy Database seit spätestens 24. Okt. 2026, 07:11 UTCWann der Eintrag vor diesem Build hinzukam, ist nicht erfasst.
Einstufung nach Quelle
NVD9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Red Hat7.4CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Trivys eigenes Label ist CRITICAL. Kritisch laut NVD, GHSA. Niedriger laut Red Hat (mittel), Ubuntu (mittel).
Beschreibung
Django 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3 use a hardcoded password for a temporary database user created when running tests with an Oracle database, which makes it easier for remote attackers to obtain access to the database server by leveraging failure to manually specify a password in the database settings TEST dictionary.
Betroffene Pakete und behobene Versionen
| Quelle | Paket | Behoben in |
|---|---|---|
| pip::GitHub Security Advisory pip | django | 1.10.3, 1.9.11, 1.8.16 |
| alpine 3.10 | py-django | 1.8.16-r0 |
| alpine 3.11 | py3-django | 1.8.16-r0 |
| alpine 3.12 | py3-django | 1.8.16-r0 |
| alpine 3.13 | py3-django | 1.8.16-r0 |
| alpine 3.14 | py3-django | 1.8.16-r0 |
| alpine 3.15 | py3-django | 1.8.16-r0 |
| alpine 3.16 | py3-django | 1.8.16-r0 |
| alpine 3.17 | py3-django | 1.8.16-r0 |
| alpine 3.18 | py3-django | 1.8.16-r0 |
| alpine 3.19 | py3-django | 1.8.16-r0 |
| alpine 3.2 | py-django | 1.8.16-r0 |
Alle 38 Einträge aus 38 Quellen zeigen
| Quelle | Paket | Behoben in |
|---|---|---|
| pip::GitHub Security Advisory pip | django | 1.10.3, 1.9.11, 1.8.16 |
| alpine 3.10 | py-django | 1.8.16-r0 |
| alpine 3.11 | py3-django | 1.8.16-r0 |
| alpine 3.12 | py3-django | 1.8.16-r0 |
| alpine 3.13 | py3-django | 1.8.16-r0 |
| alpine 3.14 | py3-django | 1.8.16-r0 |
| alpine 3.15 | py3-django | 1.8.16-r0 |
| alpine 3.16 | py3-django | 1.8.16-r0 |
| alpine 3.17 | py3-django | 1.8.16-r0 |
| alpine 3.18 | py3-django | 1.8.16-r0 |
| alpine 3.19 | py3-django | 1.8.16-r0 |
| alpine 3.2 | py-django | 1.8.16-r0 |
| alpine 3.20 | py3-django | 1.8.16-r0 |
| alpine 3.21 | py3-django | 1.8.16-r0 |
| alpine 3.22 | py3-django | 1.8.16-r0 |
| alpine 3.23 | py3-django | 1.8.16-r0 |
| alpine 3.24 | py3-django | 1.8.16-r0 |
| alpine 3.3 | py-django | 1.8.16-r0 |
| alpine 3.4 | py-django | 1.8.16-r0 |
| alpine 3.5 | py-django | 1.8.16-r0 |
| alpine 3.6 | py-django | 1.8.16-r0 |
| alpine 3.7 | py-django | 1.8.16-r0 |
| alpine 3.8 | py-django | 1.8.16-r0 |
| alpine 3.9 | py-django | 1.8.16-r0 |
| alpine edge | py3-django | 1.8.16-r0 |
| debian 11 | python-django | 1:1.10.3-1 |
| debian 12 | python-django | 1:1.10.3-1 |
| debian 13 | python-django | 1:1.10.3-1 |
| debian 14 | python-django | 1:1.10.3-1 |
| debian 7 | python-django | kein Fix angegeben |
| debian 8 | python-django | 1.7.11-1+deb8u2 |
| echo | python-django | 1:1.10.3-1 |
| ubuntu 12.04 | python-django | 1.3.1-4ubuntu1.22 |
| ubuntu 14.04 | python-django | 1.6.1-2ubuntu0.16 |
| ubuntu 14.04-ESM | python-django | 1.6.1-2ubuntu0.16 |
| ubuntu 16.04 | python-django | 1.8.7-1ubuntu5.4 |
| ubuntu 16.04-ESM | python-django | 1.8.7-1ubuntu5.4 |
| ubuntu 16.10 | python-django | 1.8.7-1ubuntu8.1 |
Referenzen
- http://www.debian.org/security/2017/dsa-3835
- http://www.securityfocus.com/bid/94069
- http://www.securitytracker.com/id/1037159
- http://www.ubuntu.com/usn/USN-3115-1
- https://access.redhat.com/security/cve/CVE-2016-9013
- https://github.com/django/django
- https://github.com/django/django/commit/34e10720d81b8d407aa14d763b6a7fe8f13b4f2e
- https://github.com/django/django/commit/4844d86c7728c1a5a3bbce4ad336a8d32304072b
Alle 19 Referenzen
- https://github.com/django/django/commit/70f99952965a430daf69eeb9947079aae535d2d0
- https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2016-17.yaml
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OG5ROMUPS6C7BXELD3TAUUH7OBYV56WQ
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OG5ROMUPS6C7BXELD3TAUUH7OBYV56WQ/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QXDKJYHN74BWY3P7AR2UZDVJREQMRE6S
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QXDKJYHN74BWY3P7AR2UZDVJREQMRE6S/
- https://nvd.nist.gov/vuln/detail/CVE-2016-9013
- https://ubuntu.com/security/notices/USN-3115-1
- https://www.cve.org/CVERecord?id=CVE-2016-9013
- https://www.djangoproject.com/weblog/2016/nov/01/security-releases
- https://www.djangoproject.com/weblog/2016/nov/01/security-releases/