crítica
CVE-2016-9013
python-django: user with hardcoded password created when running tests on Oracle
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.
Severidad por fuente
NVD9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Red Hat7.4CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD, GHSA. Más baja según Red Hat (media), Ubuntu (media).
Descripción
Django 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3 use a hardcoded password for a temporary database user created when running tests with an Oracle database, which makes it easier for remote attackers to obtain access to the database server by leveraging failure to manually specify a password in the database settings TEST dictionary.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| pip::GitHub Security Advisory pip | django | 1.10.3, 1.9.11, 1.8.16 |
| alpine 3.10 | py-django | 1.8.16-r0 |
| alpine 3.11 | py3-django | 1.8.16-r0 |
| alpine 3.12 | py3-django | 1.8.16-r0 |
| alpine 3.13 | py3-django | 1.8.16-r0 |
| alpine 3.14 | py3-django | 1.8.16-r0 |
| alpine 3.15 | py3-django | 1.8.16-r0 |
| alpine 3.16 | py3-django | 1.8.16-r0 |
| alpine 3.17 | py3-django | 1.8.16-r0 |
| alpine 3.18 | py3-django | 1.8.16-r0 |
| alpine 3.19 | py3-django | 1.8.16-r0 |
| alpine 3.2 | py-django | 1.8.16-r0 |
Mostrar las 38 entradas de 38 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| pip::GitHub Security Advisory pip | django | 1.10.3, 1.9.11, 1.8.16 |
| alpine 3.10 | py-django | 1.8.16-r0 |
| alpine 3.11 | py3-django | 1.8.16-r0 |
| alpine 3.12 | py3-django | 1.8.16-r0 |
| alpine 3.13 | py3-django | 1.8.16-r0 |
| alpine 3.14 | py3-django | 1.8.16-r0 |
| alpine 3.15 | py3-django | 1.8.16-r0 |
| alpine 3.16 | py3-django | 1.8.16-r0 |
| alpine 3.17 | py3-django | 1.8.16-r0 |
| alpine 3.18 | py3-django | 1.8.16-r0 |
| alpine 3.19 | py3-django | 1.8.16-r0 |
| alpine 3.2 | py-django | 1.8.16-r0 |
| alpine 3.20 | py3-django | 1.8.16-r0 |
| alpine 3.21 | py3-django | 1.8.16-r0 |
| alpine 3.22 | py3-django | 1.8.16-r0 |
| alpine 3.23 | py3-django | 1.8.16-r0 |
| alpine 3.24 | py3-django | 1.8.16-r0 |
| alpine 3.3 | py-django | 1.8.16-r0 |
| alpine 3.4 | py-django | 1.8.16-r0 |
| alpine 3.5 | py-django | 1.8.16-r0 |
| alpine 3.6 | py-django | 1.8.16-r0 |
| alpine 3.7 | py-django | 1.8.16-r0 |
| alpine 3.8 | py-django | 1.8.16-r0 |
| alpine 3.9 | py-django | 1.8.16-r0 |
| alpine edge | py3-django | 1.8.16-r0 |
| debian 11 | python-django | 1:1.10.3-1 |
| debian 12 | python-django | 1:1.10.3-1 |
| debian 13 | python-django | 1:1.10.3-1 |
| debian 14 | python-django | 1:1.10.3-1 |
| debian 7 | python-django | sin corrección indicada |
| debian 8 | python-django | 1.7.11-1+deb8u2 |
| echo | python-django | 1:1.10.3-1 |
| ubuntu 12.04 | python-django | 1.3.1-4ubuntu1.22 |
| ubuntu 14.04 | python-django | 1.6.1-2ubuntu0.16 |
| ubuntu 14.04-ESM | python-django | 1.6.1-2ubuntu0.16 |
| ubuntu 16.04 | python-django | 1.8.7-1ubuntu5.4 |
| ubuntu 16.04-ESM | python-django | 1.8.7-1ubuntu5.4 |
| ubuntu 16.10 | python-django | 1.8.7-1ubuntu8.1 |
Referencias
- http://www.debian.org/security/2017/dsa-3835
- http://www.securityfocus.com/bid/94069
- http://www.securitytracker.com/id/1037159
- http://www.ubuntu.com/usn/USN-3115-1
- https://access.redhat.com/security/cve/CVE-2016-9013
- https://github.com/django/django
- https://github.com/django/django/commit/34e10720d81b8d407aa14d763b6a7fe8f13b4f2e
- https://github.com/django/django/commit/4844d86c7728c1a5a3bbce4ad336a8d32304072b
Las 19 referencias
- https://github.com/django/django/commit/70f99952965a430daf69eeb9947079aae535d2d0
- https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2016-17.yaml
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OG5ROMUPS6C7BXELD3TAUUH7OBYV56WQ
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OG5ROMUPS6C7BXELD3TAUUH7OBYV56WQ/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QXDKJYHN74BWY3P7AR2UZDVJREQMRE6S
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QXDKJYHN74BWY3P7AR2UZDVJREQMRE6S/
- https://nvd.nist.gov/vuln/detail/CVE-2016-9013
- https://ubuntu.com/security/notices/USN-3115-1
- https://www.cve.org/CVERecord?id=CVE-2016-9013
- https://www.djangoproject.com/weblog/2016/nov/01/security-releases
- https://www.djangoproject.com/weblog/2016/nov/01/security-releases/