CVE-2016-9014 PUBLISHED

Django before 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3, when settings.DEBUG is True, allow remote attackers to conduct DNS rebinding attacks by leveraging failure to validate the HTTP Host header against settings.ALLOWED_HOSTS.

EPSS 3.04% · 86.6th percentile

Risk Scores

EPSS Score
3.04%
86.6th percentile

Affected Products

VendorProductVersions
Ubuntu:16.04:LTSpython-django0, 1.7.9-1ubuntu5, 1.8.5-2ubuntu1
Ubuntu:14.04:LTSpython-django1.6.1-2ubuntu0.6, 1.6.1-2ubuntu0.8, 1.6.1-2ubuntu0.9

Timeline

References

Open in Interactive Console →