id: PYSEC-2016-18
details: Django before 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before
  1.10.3, when settings.DEBUG is True, allow remote attackers to conduct DNS rebinding
  attacks by leveraging failure to validate the HTTP Host header against settings.ALLOWED_HOSTS.
affected:
- package:
    name: django
    ecosystem: PyPI
    purl: pkg:pypi/django
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 1.8.16
    - introduced: "1.9"
    - fixed: 1.9.11
    - introduced: "1.10"
    - fixed: 1.10.3
  versions:
  - 1.0.1
  - 1.0.2
  - 1.0.3
  - 1.0.4
  - "1.1"
  - 1.1.1
  - 1.1.2
  - 1.1.3
  - 1.1.4
  - "1.10"
  - 1.10.1
  - 1.10.2
  - "1.2"
  - 1.2.1
  - 1.2.2
  - 1.2.3
  - 1.2.4
  - 1.2.5
  - 1.2.6
  - 1.2.7
  - "1.3"
  - 1.3.1
  - 1.3.2
  - 1.3.3
  - 1.3.4
  - 1.3.5
  - 1.3.6
  - 1.3.7
  - "1.4"
  - 1.4.1
  - 1.4.10
  - 1.4.11
  - 1.4.12
  - 1.4.13
  - 1.4.14
  - 1.4.15
  - 1.4.16
  - 1.4.17
  - 1.4.18
  - 1.4.19
  - 1.4.2
  - 1.4.20
  - 1.4.21
  - 1.4.22
  - 1.4.3
  - 1.4.4
  - 1.4.5
  - 1.4.6
  - 1.4.7
  - 1.4.8
  - 1.4.9
  - "1.5"
  - 1.5.1
  - 1.5.10
  - 1.5.11
  - 1.5.12
  - 1.5.2
  - 1.5.3
  - 1.5.4
  - 1.5.5
  - 1.5.6
  - 1.5.7
  - 1.5.8
  - 1.5.9
  - "1.6"
  - 1.6.1
  - 1.6.10
  - 1.6.11
  - 1.6.2
  - 1.6.3
  - 1.6.4
  - 1.6.5
  - 1.6.6
  - 1.6.7
  - 1.6.8
  - 1.6.9
  - "1.7"
  - 1.7.1
  - 1.7.10
  - 1.7.11
  - 1.7.2
  - 1.7.3
  - 1.7.4
  - 1.7.5
  - 1.7.6
  - 1.7.7
  - 1.7.8
  - 1.7.9
  - "1.8"
  - 1.8.1
  - 1.8.10
  - 1.8.11
  - 1.8.12
  - 1.8.13
  - 1.8.14
  - 1.8.15
  - 1.8.2
  - 1.8.3
  - 1.8.4
  - 1.8.5
  - 1.8.6
  - 1.8.7
  - 1.8.8
  - 1.8.9
  - 1.8a1
  - 1.8b1
  - 1.8b2
  - 1.8c1
  - "1.9"
  - 1.9.1
  - 1.9.10
  - 1.9.2
  - 1.9.3
  - 1.9.4
  - 1.9.5
  - 1.9.6
  - 1.9.7
  - 1.9.8
  - 1.9.9
references:
- type: WEB
  url: 
    https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QXDKJYHN74BWY3P7AR2UZDVJREQMRE6S/
- type: WEB
  url: 
    https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OG5ROMUPS6C7BXELD3TAUUH7OBYV56WQ/
- type: WEB
  url: http://www.securitytracker.com/id/1037159
- type: ADVISORY
  url: http://www.ubuntu.com/usn/USN-3115-1
- type: ARTICLE
  url: https://www.djangoproject.com/weblog/2016/nov/01/security-releases/
- type: WEB
  url: http://www.securityfocus.com/bid/94068
- type: ADVISORY
  url: http://www.debian.org/security/2017/dsa-3835
- type: ADVISORY
  url: https://github.com/advisories/GHSA-3f2c-jm6v-cr35
aliases:
- CVE-2016-9014
- GHSA-3f2c-jm6v-cr35
modified: "2021-07-15T02:22:10.532243Z"
published: "2016-12-09T20:59:00Z"