Vulnerability advisory

PYSEC-2016-17

Published Dec 9, 2016Updated Jun 10, 2026OSV record ↗

Also known as CVE-2016-9013GHSA-mv8g-fhh6-6267

Severity

Severity not reported.

Affected versions

django PyPI

Affected	Fixed in
`1.8` to before 1.8.16	`1.8.16`Advisories →
`1.9` to before 1.9.11	`1.9.11`Advisories →
`1.10` to before 1.10.3	`1.10.3`Advisories →
Also listed as affected (30) `1.10` `1.10.1` `1.10.2` `1.8` `1.8.1` `1.8.10` `1.8.11` `1.8.12` `1.8.13` `1.8.14` `1.8.15` `1.8.2` `1.8.3` `1.8.4` `1.8.5` `1.8.6` `1.8.7` `1.8.8` `1.8.9` `1.9` `1.9.1` `1.9.10` `1.9.2` `1.9.3` `1.9.4` `1.9.5` `1.9.6` `1.9.7` `1.9.8` `1.9.9`

Description

Django 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3 use a hardcoded password for a temporary database user created when running tests with an Oracle database, which makes it easier for remote attackers to obtain access to the database server by leveraging failure to manually specify a password in the database settings TEST dictionary.

PYSEC-2016-17

Affected versions

django PyPI

Description

References