Description
Django 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3 use a hardcoded password for a temporary database user created when running tests with an Oracle database, which makes it easier for remote attackers to obtain access to the database server by leveraging failure to manually specify a password in the database settings TEST dictionary.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | python-django | 1:1.10.3-1 | — |
| Debian 13 | python-django | 1:1.10.3-1 | — |
| Debian 12 | python-django | 1:1.10.3-1 | — |
| Debian 8 | python-django | 1.7.11-1+deb8u2 | DSA-3835-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | python-django | 1.8.7-1ubuntu5.4 | USN-3115-1 |
| Ubuntu 14.04 LTS | python-django | 1.6.1-2ubuntu0.16 | USN-3115-1 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE OpenStack Cloud 7 | python-Django | 1.8.19-3.4.1 | SUSE-SU-2018:0973-1 |
| SUSE OpenStack Cloud 6 | python-Django | 1.8.19-3.6.1 | SUSE-SU-2018:1102-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | py3-django | 1.8.16-r0 | — |
| Alpine v3.23 | py3-django | 1.8.16-r0 | — |
| Alpine v3.22 | py3-django | 1.8.16-r0 | — |
| Alpine v3.21 | py3-django | 1.8.16-r0 | — |
| Alpine v3.20 | py3-django | 1.8.16-r0 | — |
Show 18 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | py3-django | 1.8.16-r0 | — |
| Alpine v3.18 | py3-django | 1.8.16-r0 | — |
| Alpine v3.17 | py3-django | 1.8.16-r0 | — |
| Alpine v3.16 | py3-django | 1.8.16-r0 | — |
| Alpine v3.15 | py3-django | 1.8.16-r0 | — |
| Alpine v3.14 | py3-django | 1.8.16-r0 | — |
| Alpine v3.13 | py3-django | 1.8.16-r0 | — |
| Alpine v3.12 | py3-django | 1.8.16-r0 | — |
| Alpine v3.11 | py3-django | 1.8.16-r0 | — |
| Alpine v3.10 | py-django | 1.8.16-r0 | — |
| Alpine v3.9 | py-django | 1.8.16-r0 | — |
| Alpine v3.8 | py-django | 1.8.16-r0 | — |
| Alpine v3.7 | py-django | 1.8.16-r0 | — |
| Alpine v3.6 | py-django | 1.8.16-r0 | — |
| Alpine v3.5 | py-django | 1.8.16-r0 | — |
| Alpine v3.4 | py-django | 1.8.16-r0 | — |
| Alpine v3.3 | py-django | 1.8.16-r0 | — |
| Alpine v3.2 | py-django | 1.8.16-r0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | django | >= 1.10a1, < 1.10.3 | 1.10.3 | GHSA-mv8g-fhh6-6267 |
| PyPI | django | >= 1.9a1, < 1.9.11 | 1.9.11 | GHSA-mv8g-fhh6-6267 |
| PyPI | django | >= 1.8a1, < 1.8.16 | 1.8.16 | GHSA-mv8g-fhh6-6267 |
| PyPI | django | >= 1.8, < 1.8.16 · >= 1.9, < 1.9.11 · >= 1.10, < 1.10.3 | 1.8.16, 1.9.11, 1.10.3 | PYSEC-2016-17 |
Advisories 4
- DSA-3835-1 python-django - security update Debian Security (DSA / DLA) · Mar 9, 2026
- USN-3115-1 python-django vulnerabilities Ubuntu Security Notices (USN) · Feb 10, 2026
- SUSE-SU-2018:1102-1 Security update for python-Django SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2018:0973-1 Security update for python-Django SUSE / openSUSE Security Updates · Feb 4, 2026
References
- https://www.djangoproject.com/weblog/2016/nov/01/security-releases/
- FEDORA-2016-d4571bf555 vendor-advisory
- DSA-3835 vendor-advisory
- USN-3115-1 vendor-advisory
- 94069 vdb-entry
- 1037159 vdb-entry
- FEDORA-2016-3eb5a55123 vendor-advisory