CVE-2016-9013

Django 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3 use a hardcoded password for a temporary database user created when running tests with an Oracle database, which makes it easier for remote attackers to obtain access to the database server by leveraging failure to manually specify a password in the database settings TEST dictionary.

Django 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3 use a hardcoded password for a temporary database user created when running tests with an Oracle database, which makes it easier for remote attackers to obtain access to the database server by leveraging failure to manually specify a password in the database settings TEST dictionary.

Django 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3 use a hardcoded password for a temporary database user created when running tests with an Oracle database, which makes it easier for remote attackers to obtain access to the database server by leveraging failure to manually specify a password in the database settings TEST dictionary.

User with hardcoded password created when running tests on Oracle When running tests with an Oracle database, Django creates a temporary database user. In older versions, if a password isn't manually specified in the database settings TEST dictionary, a hardcoded password is used. This could allow an attacker with network access to the database server to connect. (CVE-2016-9013)

DNS rebinding vulnerability when DEBUG=True Older versions of Django don't validate the Host header against settings.ALLOWED_HOSTS when settings.DEBUG=True. This makes them vulnerable to a DNS rebinding attack. (CVE-2016-9014)

Django 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3 use a hardcoded password for a temporary database user created when running tests with an Oracle database, which makes it easier for remote attackers to obtain access to the database server by leveraging failure to manually specify a password in the database settings TEST dictionary.

This update for python-Django fixes the following issues:

Security issues fixed:

• CVE-2018-7537: Fixed catastrophic backtracking in django.utils.text.Truncator. (bsc#1083305)
• CVE-2018-7536: Fixed catastrophic backtracking in urlize and urlizetrunc template filters. (bsc#1083304)
• CVE-2017-12794: Fixed XSS possibility in traceback section of technical 500 debug page (bsc#1056284)
• CVE-2017-7234: Open redirect vulnerability in django.views.static.serve() (bsc#1031451)
• CVE-2017-7233: Open redirect and possible XSS attack via user-supplied numeric redirect URLs (bsc#1031450)
• CVE-2016-9014: DNS rebinding vulnerability when DEBUG=True (bsc#1008047)
• CVE-2016-9013: User with hardcoded password created when running tests on Oracle (bsc#1008050)
• CVE-2016-7401: CSRF protection bypass on a site with Google Analytics (bsc#1001374)

This update for python-Django fixes the following issues:

Security issues fixed:

• CVE-2018-7537: Fixed catastrophic backtracking in django.utils.text.Truncator. (bsc#1083305)
• CVE-2018-7536: Fixed catastrophic backtracking in urlize and urlizetrunc template filters. (bsc#1083304)
• CVE-2017-12794: Fixed XSS possibility in traceback section of technical 500 debug page (bsc#1056284)
• CVE-2017-7234: Open redirect vulnerability in django.views.static.serve() (bsc#1031451)
• CVE-2017-7233: Open redirect and possible XSS attack via user-supplied numeric redirect URLs (bsc#1031450)
• CVE-2016-9014: DNS rebinding vulnerability when DEBUG=True (bsc#1008047)
• CVE-2016-9013: User with hardcoded password created when running tests on Oracle (bsc#1008050)
• CVE-2016-7401: CSRF protection bypass on a site with Google Analytics (bsc#1001374)
• CVE-2016-2512: Vulnerability in the function tils.http.is_safe_url could allow remote users to arbitrary web site and conduct phishing attacks. (bsc#bnc#967999)

Marti Raudsepp discovered that Django incorrectly used a hardcoded password when running tests on an Oracle database. A remote attacker could possibly connect to the database while the tests are running and prevent the test user with the hardcoded password from being removed. (CVE-2016-9013)

Aymeric Augustin discovered that Django incorrectly validated hosts when being run with the debug setting enabled. A remote attacker could possibly use this issue to perform DNS rebinding attacks. (CVE-2016-9014)