kritik
CVE-2016-9013
python-django: user with hardcoded password created when running tests on Oracle
En geç 24 Eki 2026, 07:11 UTC tarihinden beri Trivy database'indeO derlemeden önce ne zaman girdiği kayıtlı değil.
Kaynağa göre önem derecesi
NVD9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Red Hat7.4CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Trivy'nin kendi etiketi CRITICAL. Kritik diyenler: NVD, GHSA. Daha düşük diyenler: Red Hat (orta), Ubuntu (orta).
Açıklama
Django 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3 use a hardcoded password for a temporary database user created when running tests with an Oracle database, which makes it easier for remote attackers to obtain access to the database server by leveraging failure to manually specify a password in the database settings TEST dictionary.
Etkilenen paketler ve düzeltilmiş sürümler
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| pip::GitHub Security Advisory pip | django | 1.10.3, 1.9.11, 1.8.16 |
| alpine 3.10 | py-django | 1.8.16-r0 |
| alpine 3.11 | py3-django | 1.8.16-r0 |
| alpine 3.12 | py3-django | 1.8.16-r0 |
| alpine 3.13 | py3-django | 1.8.16-r0 |
| alpine 3.14 | py3-django | 1.8.16-r0 |
| alpine 3.15 | py3-django | 1.8.16-r0 |
| alpine 3.16 | py3-django | 1.8.16-r0 |
| alpine 3.17 | py3-django | 1.8.16-r0 |
| alpine 3.18 | py3-django | 1.8.16-r0 |
| alpine 3.19 | py3-django | 1.8.16-r0 |
| alpine 3.2 | py-django | 1.8.16-r0 |
38 kaynaktaki 38 kaydın hepsini göster
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| pip::GitHub Security Advisory pip | django | 1.10.3, 1.9.11, 1.8.16 |
| alpine 3.10 | py-django | 1.8.16-r0 |
| alpine 3.11 | py3-django | 1.8.16-r0 |
| alpine 3.12 | py3-django | 1.8.16-r0 |
| alpine 3.13 | py3-django | 1.8.16-r0 |
| alpine 3.14 | py3-django | 1.8.16-r0 |
| alpine 3.15 | py3-django | 1.8.16-r0 |
| alpine 3.16 | py3-django | 1.8.16-r0 |
| alpine 3.17 | py3-django | 1.8.16-r0 |
| alpine 3.18 | py3-django | 1.8.16-r0 |
| alpine 3.19 | py3-django | 1.8.16-r0 |
| alpine 3.2 | py-django | 1.8.16-r0 |
| alpine 3.20 | py3-django | 1.8.16-r0 |
| alpine 3.21 | py3-django | 1.8.16-r0 |
| alpine 3.22 | py3-django | 1.8.16-r0 |
| alpine 3.23 | py3-django | 1.8.16-r0 |
| alpine 3.24 | py3-django | 1.8.16-r0 |
| alpine 3.3 | py-django | 1.8.16-r0 |
| alpine 3.4 | py-django | 1.8.16-r0 |
| alpine 3.5 | py-django | 1.8.16-r0 |
| alpine 3.6 | py-django | 1.8.16-r0 |
| alpine 3.7 | py-django | 1.8.16-r0 |
| alpine 3.8 | py-django | 1.8.16-r0 |
| alpine 3.9 | py-django | 1.8.16-r0 |
| alpine edge | py3-django | 1.8.16-r0 |
| debian 11 | python-django | 1:1.10.3-1 |
| debian 12 | python-django | 1:1.10.3-1 |
| debian 13 | python-django | 1:1.10.3-1 |
| debian 14 | python-django | 1:1.10.3-1 |
| debian 7 | python-django | düzeltme belirtilmemiş |
| debian 8 | python-django | 1.7.11-1+deb8u2 |
| echo | python-django | 1:1.10.3-1 |
| ubuntu 12.04 | python-django | 1.3.1-4ubuntu1.22 |
| ubuntu 14.04 | python-django | 1.6.1-2ubuntu0.16 |
| ubuntu 14.04-ESM | python-django | 1.6.1-2ubuntu0.16 |
| ubuntu 16.04 | python-django | 1.8.7-1ubuntu5.4 |
| ubuntu 16.04-ESM | python-django | 1.8.7-1ubuntu5.4 |
| ubuntu 16.10 | python-django | 1.8.7-1ubuntu8.1 |
Referanslar
- http://www.debian.org/security/2017/dsa-3835
- http://www.securityfocus.com/bid/94069
- http://www.securitytracker.com/id/1037159
- http://www.ubuntu.com/usn/USN-3115-1
- https://access.redhat.com/security/cve/CVE-2016-9013
- https://github.com/django/django
- https://github.com/django/django/commit/34e10720d81b8d407aa14d763b6a7fe8f13b4f2e
- https://github.com/django/django/commit/4844d86c7728c1a5a3bbce4ad336a8d32304072b
19 referansın hepsi
- https://github.com/django/django/commit/70f99952965a430daf69eeb9947079aae535d2d0
- https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2016-17.yaml
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OG5ROMUPS6C7BXELD3TAUUH7OBYV56WQ
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OG5ROMUPS6C7BXELD3TAUUH7OBYV56WQ/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QXDKJYHN74BWY3P7AR2UZDVJREQMRE6S
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QXDKJYHN74BWY3P7AR2UZDVJREQMRE6S/
- https://nvd.nist.gov/vuln/detail/CVE-2016-9013
- https://ubuntu.com/security/notices/USN-3115-1
- https://www.cve.org/CVERecord?id=CVE-2016-9013
- https://www.djangoproject.com/weblog/2016/nov/01/security-releases
- https://www.djangoproject.com/weblog/2016/nov/01/security-releases/