critique
CVE-2016-9013
python-django: user with hardcoded password created when running tests on Oracle
Dans la Trivy database depuis au moins le 24 oct. 2026, 07:11 UTCLa date d'entrée avant ce build n'est pas enregistrée.
Sévérité par source
NVD9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Red Hat7.4CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Le label propre à Trivy est CRITICAL. Critique selon NVD, GHSA. Plus basse selon Red Hat (moyenne), Ubuntu (moyenne).
Description
Django 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3 use a hardcoded password for a temporary database user created when running tests with an Oracle database, which makes it easier for remote attackers to obtain access to the database server by leveraging failure to manually specify a password in the database settings TEST dictionary.
Paquets affectés et versions corrigées
| Source | Paquet | Corrigé en |
|---|---|---|
| pip::GitHub Security Advisory pip | django | 1.10.3, 1.9.11, 1.8.16 |
| alpine 3.10 | py-django | 1.8.16-r0 |
| alpine 3.11 | py3-django | 1.8.16-r0 |
| alpine 3.12 | py3-django | 1.8.16-r0 |
| alpine 3.13 | py3-django | 1.8.16-r0 |
| alpine 3.14 | py3-django | 1.8.16-r0 |
| alpine 3.15 | py3-django | 1.8.16-r0 |
| alpine 3.16 | py3-django | 1.8.16-r0 |
| alpine 3.17 | py3-django | 1.8.16-r0 |
| alpine 3.18 | py3-django | 1.8.16-r0 |
| alpine 3.19 | py3-django | 1.8.16-r0 |
| alpine 3.2 | py-django | 1.8.16-r0 |
Afficher les 38 entrées de 38 sources
| Source | Paquet | Corrigé en |
|---|---|---|
| pip::GitHub Security Advisory pip | django | 1.10.3, 1.9.11, 1.8.16 |
| alpine 3.10 | py-django | 1.8.16-r0 |
| alpine 3.11 | py3-django | 1.8.16-r0 |
| alpine 3.12 | py3-django | 1.8.16-r0 |
| alpine 3.13 | py3-django | 1.8.16-r0 |
| alpine 3.14 | py3-django | 1.8.16-r0 |
| alpine 3.15 | py3-django | 1.8.16-r0 |
| alpine 3.16 | py3-django | 1.8.16-r0 |
| alpine 3.17 | py3-django | 1.8.16-r0 |
| alpine 3.18 | py3-django | 1.8.16-r0 |
| alpine 3.19 | py3-django | 1.8.16-r0 |
| alpine 3.2 | py-django | 1.8.16-r0 |
| alpine 3.20 | py3-django | 1.8.16-r0 |
| alpine 3.21 | py3-django | 1.8.16-r0 |
| alpine 3.22 | py3-django | 1.8.16-r0 |
| alpine 3.23 | py3-django | 1.8.16-r0 |
| alpine 3.24 | py3-django | 1.8.16-r0 |
| alpine 3.3 | py-django | 1.8.16-r0 |
| alpine 3.4 | py-django | 1.8.16-r0 |
| alpine 3.5 | py-django | 1.8.16-r0 |
| alpine 3.6 | py-django | 1.8.16-r0 |
| alpine 3.7 | py-django | 1.8.16-r0 |
| alpine 3.8 | py-django | 1.8.16-r0 |
| alpine 3.9 | py-django | 1.8.16-r0 |
| alpine edge | py3-django | 1.8.16-r0 |
| debian 11 | python-django | 1:1.10.3-1 |
| debian 12 | python-django | 1:1.10.3-1 |
| debian 13 | python-django | 1:1.10.3-1 |
| debian 14 | python-django | 1:1.10.3-1 |
| debian 7 | python-django | pas de correctif indiqué |
| debian 8 | python-django | 1.7.11-1+deb8u2 |
| echo | python-django | 1:1.10.3-1 |
| ubuntu 12.04 | python-django | 1.3.1-4ubuntu1.22 |
| ubuntu 14.04 | python-django | 1.6.1-2ubuntu0.16 |
| ubuntu 14.04-ESM | python-django | 1.6.1-2ubuntu0.16 |
| ubuntu 16.04 | python-django | 1.8.7-1ubuntu5.4 |
| ubuntu 16.04-ESM | python-django | 1.8.7-1ubuntu5.4 |
| ubuntu 16.10 | python-django | 1.8.7-1ubuntu8.1 |
Références
- http://www.debian.org/security/2017/dsa-3835
- http://www.securityfocus.com/bid/94069
- http://www.securitytracker.com/id/1037159
- http://www.ubuntu.com/usn/USN-3115-1
- https://access.redhat.com/security/cve/CVE-2016-9013
- https://github.com/django/django
- https://github.com/django/django/commit/34e10720d81b8d407aa14d763b6a7fe8f13b4f2e
- https://github.com/django/django/commit/4844d86c7728c1a5a3bbce4ad336a8d32304072b
Les 19 références
- https://github.com/django/django/commit/70f99952965a430daf69eeb9947079aae535d2d0
- https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2016-17.yaml
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OG5ROMUPS6C7BXELD3TAUUH7OBYV56WQ
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OG5ROMUPS6C7BXELD3TAUUH7OBYV56WQ/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QXDKJYHN74BWY3P7AR2UZDVJREQMRE6S
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QXDKJYHN74BWY3P7AR2UZDVJREQMRE6S/
- https://nvd.nist.gov/vuln/detail/CVE-2016-9013
- https://ubuntu.com/security/notices/USN-3115-1
- https://www.cve.org/CVERecord?id=CVE-2016-9013
- https://www.djangoproject.com/weblog/2016/nov/01/security-releases
- https://www.djangoproject.com/weblog/2016/nov/01/security-releases/