Vulnerability advisory

GHSA-3f2c-jm6v-cr35

Django DNS Rebinding Vulnerability

Published May 17, 2022Updated Nov 28, 2024OSV record ↗

Also known as CVE-2016-9014PYSEC-2016-18

Severity

CVSS 3.xCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 4.0CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Affected versions

django PyPI

All django advisories →

Affected	Fixed in
`1.8a1` to before 1.8.16	`1.8.16`Advisories →
Also listed as affected (20) `1.8` `1.8.1` `1.8.10` `1.8.11` `1.8.12` `1.8.13` `1.8.14` `1.8.15` `1.8.2` `1.8.3` `1.8.4` `1.8.5` `1.8.6` `1.8.7` `1.8.8` `1.8.9` `1.8a1` `1.8b1` `1.8b2` `1.8c1`
`1.9a1` to before 1.9.11	`1.9.11`Advisories →
Also listed as affected (15) `1.9` `1.9.1` `1.9.10` `1.9.2` `1.9.3` `1.9.4` `1.9.5` `1.9.6` `1.9.7` `1.9.8` `1.9.9` `1.9a1` `1.9b1` `1.9rc1` `1.9rc2`
`1.10a1` to before 1.10.3	`1.10.3`Advisories →
Also listed as affected (6) `1.10` `1.10.1` `1.10.2` `1.10a1` `1.10b1` `1.10rc1`

Description

Django before 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3, when settings.DEBUG is True, allow remote attackers to conduct DNS rebinding attacks by leveraging failure to validate the HTTP Host header against settings.ALLOWED_HOSTS.

GHSA-3f2c-jm6v-cr35

Affected versions

django PyPI

Description

References