{"id":"CVE-2016-2513","aliases":["DEBIAN-CVE-2016-2513","DSA-3544-1","EUVD-2016-0005","GHSA-fp6p-5xvw-m74f","MGASA-2016-0096","PYSEC-2016-16","RHSA-2016:0502","RHSA-2016:0503","RHSA-2016:0504","RHSA-2016:0505","RHSA-2016:0506","UBUNTU-CVE-2016-2513","USN-2915-1","openSUSE-SU-2024:10361-1"],"status":"published","title":"Django User Enumeration Vulnerability","description":"The password hasher in contrib/auth/hashers.py in Django before 1.8.10 and 1.9.x before 1.9.3 allows remote attackers to enumerate users via a timing attack involving login requests.","severity":{"version":"3.0","score":3.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","level":"low","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.03409,"percentile":0.88957,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200"],"published":"2016-03-01T17:00:00Z","modified":"2026-10-20T10:47:29Z","fixes":[{"ecosystem":"PyPI","package":"django","fixed_in":["1.8.10","1.9.3"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"python-django","fixed_in":["1.9.4-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"python-django","fixed_in":["1.9.4-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"python-django","fixed_in":["1.9.4-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"python-django","fixed_in":["1.6.1-2ubuntu0.12"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.10"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.9"},{"fixed":"1.9.3"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.4-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.4-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.4-1"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.5-1+deb7u16"}]}],"versions":["1.4.5-1","1.4.5-1+deb7u1","1.4.5-1+deb7u10","1.4.5-1+deb7u11","1.4.5-1+deb7u11~bpo60+1","1.4.5-1+deb7u12","1.4.5-1+deb7u13","1.4.5-1+deb7u13~bpo60+1","1.4.5-1+deb7u14","1.4.5-1+deb7u14~bpo60+1","1.4.5-1+deb7u15","1.4.5-1+deb7u2","1.4.5-1+deb7u3","1.4.5-1+deb7u4","1.4.5-1+deb7u4~bpo60+1","1.4.5-1+deb7u5","1.4.5-1+deb7u6","1.4.5-1+deb7u7","1.4.5-1+deb7u7~bpo60+1","1.4.5-1+deb7u8","1.4.5-1+deb7u8~bpo60+1","1.4.5-1+deb7u9"],"bundled":2},{"source":"osv","ecosystem":"Debian:8","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.7-1+deb8u4"}]}],"versions":["1.7.7-1","1.7.7-1+deb8u1","1.7.7-1+deb8u2","1.7.7-1+deb8u3"],"bundled":2},{"source":"osv","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.10"}]}],"versions":["1.0.1","1.0.2","1.0.3","1.0.4","1.1","1.1.1","1.1.2","1.1.3","1.1.4","1.2","1.2.1","1.2.2","1.2.3","1.2.4","1.2.5","1.2.6","1.2.7","1.3","1.3.1","1.3.2","1.3.3","1.3.4","1.3.5","1.3.6","1.3.7","1.4","1.4.1","1.4.10","1.4.11","1.4.12","1.4.13","1.4.14","1.4.15","1.4.16","1.4.17","1.4.18","1.4.19","1.4.2","1.4.20","1.4.21","1.4.22","1.4.3","1.4.4","1.4.5","1.4.6","1.4.7","1.4.8","1.4.9","1.5","1.5.1","1.5.10","1.5.11","1.5.12","1.5.2","1.5.3","1.5.4","1.5.5","1.5.6","1.5.7","1.5.8","1.5.9","1.6","1.6.1","1.6.10","1.6.11","1.6.2","1.6.3","1.6.4","1.6.5","1.6.6","1.6.7","1.6.8","1.6.9","1.7","1.7.1","1.7.10","1.7.11","1.7.2","1.7.3","1.7.4","1.7.5","1.7.6","1.7.7","1.7.8","1.7.9","1.8","1.8.1","1.8.2","1.8.3","1.8.4","1.8.5","1.8.6","1.8.7","1.8.8","1.8.9","1.8a1","1.8b1","1.8b2","1.8c1"]},{"source":"osv","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.9"},{"fixed":"1.9.3"}]}],"versions":["1.9","1.9.1","1.9.2"]},{"source":"osv","ecosystem":"Mageia:5","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.10-1.mga5"}]}],"bundled":2},{"source":"osv","ecosystem":"PyPI","package":"django","ranges":[{"type":"GIT","events":[{"introduced":"0"},{"fixed":"67b46ba7016da2d259c1ecc7d666d11f5e1cfaab"}]},{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.10"},{"introduced":"1.9"},{"fixed":"1.9.3"}]}],"versions":["1.0.1","1.0.2","1.0.3","1.0.4","1.1","1.1.1","1.1.2","1.1.3","1.1.4","1.2","1.2.1","1.2.2","1.2.3","1.2.4","1.2.5","1.2.6","1.2.7","1.3","1.3.1","1.3.2","1.3.3","1.3.4","1.3.5","1.3.6","1.3.7","1.4","1.4.1","1.4.10","1.4.11","1.4.12","1.4.13","1.4.14","1.4.15","1.4.16","1.4.17","1.4.18","1.4.19","1.4.2","1.4.20","1.4.21","1.4.22","1.4.3","1.4.4","1.4.5","1.4.6","1.4.7","1.4.8","1.4.9","1.5","1.5.1","1.5.10","1.5.11","1.5.12","1.5.2","1.5.3","1.5.4","1.5.5","1.5.6","1.5.7","1.5.8","1.5.9","1.6","1.6.1","1.6.10","1.6.11","1.6.2","1.6.3","1.6.4","1.6.5","1.6.6","1.6.7","1.6.8","1.6.9","1.7","1.7.1","1.7.10","1.7.11","1.7.2","1.7.3","1.7.4","1.7.5","1.7.6","1.7.7","1.7.8","1.7.9","1.8","1.8.1","1.8.2","1.8.3","1.8.4","1.8.5","1.8.6","1.8.7","1.8.8","1.8.9","1.8a1","1.8b1","1.8b2","1.8c1","1.9","1.9.1","1.9.2","1.7a2","1.0"]},{"source":"osv","ecosystem":"Red Hat:openstack:5::el6","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-5.el6ost"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openstack:5::el6","package":"python-django-bash-completion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-5.el6ost"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openstack:5::el6","package":"python-django-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-5.el6ost"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openstack-optools:7::el7","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-5.el7ost"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openstack-optools:7::el7","package":"python-django-bash-completion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-5.el7ost"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openstack:7::el7","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.11-1.el7ost"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openstack:7::el7","package":"python-django-bash-completion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.11-1.el7ost"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openstack:7::el7","package":"python-django-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.11-1.el7ost"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openstack:6::el7","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-5.el7ost"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openstack:6::el7","package":"python-django-bash-completion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-5.el7ost"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openstack:6::el7","package":"python-django-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-5.el7ost"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openstack:5::el7","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-5.el7ost"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openstack:5::el7","package":"python-django-bash-completion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-5.el7ost"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openstack:5::el7","package":"python-django-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-5.el7ost"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-2ubuntu0.12"}]}],"versions":["1.5.4-1ubuntu1","1.6-1","1.6.1-1","1.6.1-2","1.6.1-2ubuntu0.1","1.6.1-2ubuntu0.2","1.6.1-2ubuntu0.3","1.6.1-2ubuntu0.4","1.6.1-2ubuntu0.5","1.6.1-2ubuntu0.6","1.6.1-2ubuntu0.8","1.6.1-2ubuntu0.9","1.6.1-2ubuntu0.10","1.6.1-2ubuntu0.11"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-2ubuntu0.12"}]}],"versions":["1.5.4-1ubuntu1","1.6-1","1.6.1-1","1.6.1-2","1.6.1-2ubuntu0.1","1.6.1-2ubuntu0.2","1.6.1-2ubuntu0.3","1.6.1-2ubuntu0.4","1.6.1-2ubuntu0.5","1.6.1-2ubuntu0.6","1.6.1-2ubuntu0.8","1.6.1-2ubuntu0.9","1.6.1-2ubuntu0.10","1.6.1-2ubuntu0.11"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-Django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.4-1.1"}]}],"bundled":2}],"products":[{"vendor":"djangoproject","product":"django"}],"references":[{"url":"http://rhn.redhat.com/errata/RHSA-2016-0506.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"https://github.com/django/django/commit/67b46ba7016da2d259c1ecc7d666d11f5e1cfaab","tags":["x_refsource_CONFIRM","x_transferred","fix","web"]},{"url":"http://www.securitytracker.com/id/1035152","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2016-0504.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"http://www.debian.org/security/2016/dsa-3544","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2016-0502.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"http://www.ubuntu.com/usn/USN-2915-3","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory","web"]},{"url":"http://www.securityfocus.com/bid/83878","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.ubuntu.com/usn/USN-2915-2","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2016-0505.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"http://www.ubuntu.com/usn/USN-2915-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory","web"]},{"url":"https://www.djangoproject.com/weblog/2016/mar/01/security-releases/","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web","article","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-2513","tags":["advisory"]},{"url":"https://web.archive.org/web/20160322001143/http://www.securitytracker.com/id/1035152","tags":["web"]},{"url":"https://web.archive.org/web/20200228001222/http://www.securityfocus.com/bid/83878","tags":["web"]},{"url":"https://github.com/django/django/commit/af7d09b0c5c6ab68e629fd9baf736f9dd203b18e","tags":["web"]},{"url":"https://github.com/django/django/commit/f4e6e02f7713a6924d16540be279909ff4091eb6","tags":["web"]},{"url":"https://www.djangoproject.com/weblog/2016/mar/01/security-releases","tags":["web"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2016-16.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-fp6p-5xvw-m74f","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2016-2513","tags":["advisory"]},{"url":"https://github.com/django/django","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2016-0096.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=17860","tags":["report"]},{"url":"http://www.ubuntu.com/usn/usn-2915-1/","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2016:0502","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1311431","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1311438","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_0502.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-2512","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-2512","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-2512","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-2513","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-2513","tags":["advisory","report"]},{"url":"https://access.redhat.com/errata/RHSA-2016:0503","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_0503.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2016:0504","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_0504.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2016:0505","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_0505.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2016:0506","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_0506.json","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2016-2513","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2915-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2016-2512","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2512","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2513","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2016-2513","description":"The password hasher in contrib/auth/hashers.py in Django before 1.8.10 and 1.9.x before 1.9.3 allows remote attackers to enumerate users via a timing attack involving login requests.","status":"published","published":"2016-04-08T15:00:00Z","modified":"2024-08-05T23:32:20.44Z","updated_at":"2026-11-02T14:33:33.424551Z"}],"euvd":[{"id":"EUVD-2016-0005","description":"The password hasher in contrib/auth/hashers.py in Django before 1.8.10 and 1.9.x before 1.9.3 allows remote attackers to enumerate users via a timing attack involving login requests.","status":"published","published":"2016-04-08T15:00:00Z","modified":"2024-08-05T23:32:20Z","updated_at":"2026-11-03T02:22:53.17975Z"}],"ghsa":[{"id":"GHSA-fp6p-5xvw-m74f","title":"Django User Enumeration Vulnerability","description":"The password hasher in `contrib/auth/hashers.py` in Django before 1.8.10 and 1.9.x before 1.9.3 allows remote attackers to enumerate users via a timing attack involving login requests.","status":"published","published":"2022-05-17T01:09:58Z","modified":"2024-09-18T14:35:48Z","cvss":[{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"low"},{"version":"3.0","score":3.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:38:03.800952Z"}],"nvd":[{"id":"CVE-2016-2513","description":"The password hasher in contrib/auth/hashers.py in Django before 1.8.10 and 1.9.x before 1.9.3 allows remote attackers to enumerate users via a timing attack involving login requests.","status":"published","published":"2016-04-08T15:59:07.23Z","modified":"2026-06-17T00:44:12.077Z","cvss":[{"version":"3.0","score":3.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","level":"low","assessor":"primary"},{"version":"2.0","score":2.6,"vector":"AV:N/AC:H/Au:N/C:P/I:N/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:03:23.795791Z"}],"osv":[{"id":"CVE-2016-2513","description":"The password hasher in contrib/auth/hashers.py in Django before 1.8.10 and 1.9.x before 1.9.3 allows remote attackers to enumerate users via a timing attack involving login requests.","status":"published","published":"2016-04-08T15:59:07.23Z","modified":"2026-10-20T10:47:29.147405243Z","cvss":[{"version":"3.0","score":3.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T15:44:02.114472Z"},{"id":"DEBIAN-CVE-2016-2513","description":"The password hasher in contrib/auth/hashers.py in Django before 1.8.10 and 1.9.x before 1.9.3 allows remote attackers to enumerate users via a timing attack involving login requests.","status":"published","published":"2016-04-08T15:59:07.23Z","modified":"2026-09-22T07:01:51.285343917Z","cvss":[{"version":"3.0","score":3.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T15:45:27.627285Z"},{"id":"GHSA-fp6p-5xvw-m74f","title":"Django User Enumeration Vulnerability","description":"The password hasher in `contrib/auth/hashers.py` in Django before 1.8.10 and 1.9.x before 1.9.3 allows remote attackers to enumerate users via a timing attack involving login requests.","status":"published","published":"2022-05-17T01:09:58Z","modified":"2024-09-18T14:57:57.828439Z","cvss":[{"version":"3.0","score":3.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","level":"low"},{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"low"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:46:46.760785Z"},{"id":"UBUNTU-CVE-2016-2513","description":"The password hasher in contrib/auth/hashers.py in Django before 1.8.10 and 1.9.x before 1.9.3 allows remote attackers to enumerate users via a timing attack involving login requests.","status":"published","published":"2016-03-01T17:00:00Z","modified":"2026-02-04T04:33:42.37581Z","cvss":[{"version":"3.0","score":3.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T15:54:11.872222Z"},{"id":"DSA-3544-1","title":"python-django - security update","status":"published","published":"2016-04-07T00:00:00Z","modified":"2026-03-09T02:10:02.331781Z","updated_at":"2026-11-02T15:46:16.199525Z"},{"id":"MGASA-2016-0096","title":"Updated python-django packages fix security vulnerability","description":"Mark Striemer discovered that Django incorrectly handled user-supplied\nredirect URLs containing basic authentication credentials. A remote\nattacker could possibly use this issue to perform a cross-site scripting\nattack or a malicious redirect. (CVE-2016-2512)\n\nSjoerd Job Postmus discovered that Django incorrectly handled timing when\ndoing password hashing operations. A remote attacker could possibly use\nthis issue to perform user enumeration. (CVE-2016-2513)\n","status":"published","published":"2016-03-07T11:20:30Z","modified":"2026-04-16T06:23:23.906549639Z","updated_at":"2026-11-02T15:49:39.792687Z"},{"id":"openSUSE-SU-2024:10361-1","title":"python3-Django-1.10.4-1.1 on GA media","description":"These are all security issues fixed in the python3-Django-1.10.4-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:00:25.484609Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"PYSEC-2016-16","description":"The password hasher in contrib/auth/hashers.py in Django before 1.8.10 and 1.9.x before 1.9.3 allows remote attackers to enumerate users via a timing attack involving login requests.","status":"published","published":"2016-04-08T15:59:00Z","modified":"2026-06-10T17:01:00.699412456Z","updated_at":"2026-11-02T15:52:51.645172Z"},{"id":"RHSA-2016:0502","title":"Red Hat Security Advisory: python-django security update","status":"published","published":"2024-09-13T11:31:24Z","modified":"2026-06-29T10:11:59Z","updated_at":"2026-11-02T15:53:03.734507Z"},{"id":"RHSA-2016:0503","title":"Red Hat Security Advisory: python-django security update","status":"published","published":"2024-09-13T11:31:40Z","modified":"2026-06-29T10:12:00Z","updated_at":"2026-11-02T15:53:03.734507Z"},{"id":"RHSA-2016:0504","title":"Red Hat Security Advisory: python-django security update","status":"published","published":"2024-09-13T11:31:34Z","modified":"2026-06-29T10:12:01Z","updated_at":"2026-11-02T15:53:03.734507Z"},{"id":"RHSA-2016:0505","title":"Red Hat Security Advisory: python-django security update","status":"published","published":"2024-09-13T11:31:29Z","modified":"2026-06-29T10:12:01Z","updated_at":"2026-11-02T15:53:03.734507Z"},{"id":"RHSA-2016:0506","title":"Red Hat Security Advisory: python-django security update","status":"published","published":"2024-09-13T11:31:48Z","modified":"2026-06-29T10:12:02Z","updated_at":"2026-11-02T15:53:03.734507Z"},{"id":"USN-2915-1","title":"python-django vulnerabilities","description":"Mark Striemer discovered that Django incorrectly handled user-supplied\nredirect URLs containing basic authentication credentials. A remote\nattacker could possibly use this issue to perform a cross-site scripting\nattack or a malicious redirect. (CVE-2016-2512)\n\nSjoerd Job Postmus discovered that Django incorrectly handled timing when\ndoing password hashing operations. A remote attacker could possibly use\nthis issue to perform user enumeration. (CVE-2016-2513)\n","status":"published","published":"2016-03-01T18:35:12Z","modified":"2026-02-10T04:40:57Z","updated_at":"2026-11-02T16:58:10.303275Z"}]}}