python-django - security update

Fixed packages 1

Vulnerabilities 4

• Critical 9.8
  CVE-2016-9013

  Django user with hardcoded password created when running tests on Oracle

  Django 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3 use a hardcoded password for a temporary database user created when running tests with an Oracle database, which makes it easier for remote attackers to obtain access to the database se…

  python-django django python-django py3-django Debian Ubuntu Alpine PyPI
  Dec 9, 2016
• High 8.1
  CVE-2016-9014

  Django DNS Rebinding Vulnerability

  Django before 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3, when settings.DEBUG is True, allow remote attackers to conduct DNS rebinding attacks by leveraging failure to validate the HTTP Host header against settings.ALLOWED_HOSTS.

  python-django django python-django py3-django Debian Ubuntu Alpine PyPI
  Dec 9, 2016
• Medium 6.1
  CVE-2017-7233

  Django open redirect and possible XSS attack via user-supplied numeric redirect URLs

  Django 1.10 before 1.10.7, 1.9 before 1.9.13, and 1.8 before 1.8.18 relies on user input in some cases to redirect the user to an "on success" URL. The security check for these redirects (namely ``django.utils.http.is_safe_url()``) considered some numeric URL…

  python-django django python-django py3-django Debian Ubuntu Alpine PyPI
  Apr 4, 2017
• Medium 6.1
  CVE-2017-7234

  Django open redirect

  A maliciously crafted URL to a Django (1.10 before 1.10.7, 1.9 before 1.9.13, and 1.8 before 1.8.18) site using the ``django.views.static.serve()`` view could redirect to any other domain, aka an open redirect vulnerability.

  python-django django python-django py3-django Debian Ubuntu Alpine PyPI
  Apr 4, 2017