Django before 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3, when settings.DEBUG is True, allow remote attackers to conduct DNS rebinding attacks by leveraging failure to validate the HTTP Host header against settings.ALLOWED_HOSTS.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2016-9014US | high8.1 | — | ||
Django before 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3, when settings.DEBUG is True, allow remote attackers to conduct DNS rebinding attacks by leveraging… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- http://www.debian.org/security/2017/dsa-3835ADVISORY
- http://www.securityfocus.com/bid/94068WEB
- http://www.securitytracker.com/id/1037159WEB
- http://www.ubuntu.com/usn/USN-3115-1ADVISORY
- https://github.com/advisories/GHSA-3f2c-jm6v-cr35ADVISORY
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OG5ROMUPS6C7BXELD3TAUUH7OBYV56WQ/WEB
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QXDKJYHN74BWY3P7AR2UZDVJREQMRE6S/WEB
- https://www.djangoproject.com/weblog/2016/nov/01/security-releases/ARTICLE
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan