critical
CVE-2016-9013
python-django: user with hardcoded password created when running tests on Oracle
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.
Severity by source
NVD9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Red Hat7.4CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Trivy's own label is CRITICAL. Rated critical by NVD, GHSA. Rated lower by Red Hat (medium), Ubuntu (medium).
Description
Django 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3 use a hardcoded password for a temporary database user created when running tests with an Oracle database, which makes it easier for remote attackers to obtain access to the database server by leveraging failure to manually specify a password in the database settings TEST dictionary.
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| pip::GitHub Security Advisory pip | django | 1.10.3, 1.9.11, 1.8.16 |
| alpine 3.10 | py-django | 1.8.16-r0 |
| alpine 3.11 | py3-django | 1.8.16-r0 |
| alpine 3.12 | py3-django | 1.8.16-r0 |
| alpine 3.13 | py3-django | 1.8.16-r0 |
| alpine 3.14 | py3-django | 1.8.16-r0 |
| alpine 3.15 | py3-django | 1.8.16-r0 |
| alpine 3.16 | py3-django | 1.8.16-r0 |
| alpine 3.17 | py3-django | 1.8.16-r0 |
| alpine 3.18 | py3-django | 1.8.16-r0 |
| alpine 3.19 | py3-django | 1.8.16-r0 |
| alpine 3.2 | py-django | 1.8.16-r0 |
Show all 38 entries from 38 sources
| Source | Package | Fixed in |
|---|---|---|
| pip::GitHub Security Advisory pip | django | 1.10.3, 1.9.11, 1.8.16 |
| alpine 3.10 | py-django | 1.8.16-r0 |
| alpine 3.11 | py3-django | 1.8.16-r0 |
| alpine 3.12 | py3-django | 1.8.16-r0 |
| alpine 3.13 | py3-django | 1.8.16-r0 |
| alpine 3.14 | py3-django | 1.8.16-r0 |
| alpine 3.15 | py3-django | 1.8.16-r0 |
| alpine 3.16 | py3-django | 1.8.16-r0 |
| alpine 3.17 | py3-django | 1.8.16-r0 |
| alpine 3.18 | py3-django | 1.8.16-r0 |
| alpine 3.19 | py3-django | 1.8.16-r0 |
| alpine 3.2 | py-django | 1.8.16-r0 |
| alpine 3.20 | py3-django | 1.8.16-r0 |
| alpine 3.21 | py3-django | 1.8.16-r0 |
| alpine 3.22 | py3-django | 1.8.16-r0 |
| alpine 3.23 | py3-django | 1.8.16-r0 |
| alpine 3.24 | py3-django | 1.8.16-r0 |
| alpine 3.3 | py-django | 1.8.16-r0 |
| alpine 3.4 | py-django | 1.8.16-r0 |
| alpine 3.5 | py-django | 1.8.16-r0 |
| alpine 3.6 | py-django | 1.8.16-r0 |
| alpine 3.7 | py-django | 1.8.16-r0 |
| alpine 3.8 | py-django | 1.8.16-r0 |
| alpine 3.9 | py-django | 1.8.16-r0 |
| alpine edge | py3-django | 1.8.16-r0 |
| debian 11 | python-django | 1:1.10.3-1 |
| debian 12 | python-django | 1:1.10.3-1 |
| debian 13 | python-django | 1:1.10.3-1 |
| debian 14 | python-django | 1:1.10.3-1 |
| debian 7 | python-django | no fix listed |
| debian 8 | python-django | 1.7.11-1+deb8u2 |
| echo | python-django | 1:1.10.3-1 |
| ubuntu 12.04 | python-django | 1.3.1-4ubuntu1.22 |
| ubuntu 14.04 | python-django | 1.6.1-2ubuntu0.16 |
| ubuntu 14.04-ESM | python-django | 1.6.1-2ubuntu0.16 |
| ubuntu 16.04 | python-django | 1.8.7-1ubuntu5.4 |
| ubuntu 16.04-ESM | python-django | 1.8.7-1ubuntu5.4 |
| ubuntu 16.10 | python-django | 1.8.7-1ubuntu8.1 |
References
- http://www.debian.org/security/2017/dsa-3835
- http://www.securityfocus.com/bid/94069
- http://www.securitytracker.com/id/1037159
- http://www.ubuntu.com/usn/USN-3115-1
- https://access.redhat.com/security/cve/CVE-2016-9013
- https://github.com/django/django
- https://github.com/django/django/commit/34e10720d81b8d407aa14d763b6a7fe8f13b4f2e
- https://github.com/django/django/commit/4844d86c7728c1a5a3bbce4ad336a8d32304072b
All 19 references
- https://github.com/django/django/commit/70f99952965a430daf69eeb9947079aae535d2d0
- https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2016-17.yaml
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OG5ROMUPS6C7BXELD3TAUUH7OBYV56WQ
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OG5ROMUPS6C7BXELD3TAUUH7OBYV56WQ/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QXDKJYHN74BWY3P7AR2UZDVJREQMRE6S
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QXDKJYHN74BWY3P7AR2UZDVJREQMRE6S/
- https://nvd.nist.gov/vuln/detail/CVE-2016-9013
- https://ubuntu.com/security/notices/USN-3115-1
- https://www.cve.org/CVERecord?id=CVE-2016-9013
- https://www.djangoproject.com/weblog/2016/nov/01/security-releases
- https://www.djangoproject.com/weblog/2016/nov/01/security-releases/