PYSEC-2016-17

See a problem?
Import Source
https://github.com/pypa/advisory-database/blob/main/vulns/django/PYSEC-2016-17.yaml
JSON Data
https://api.osv.dev/v1/vulns/PYSEC-2016-17
Aliases
Published
2016-12-09T20:59:00Z
Modified
2024-04-22T23:11:35.777336Z
Summary
[none]
Details

Django 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3 use a hardcoded password for a temporary database user created when running tests with an Oracle database, which makes it easier for remote attackers to obtain access to the database server by leveraging failure to manually specify a password in the database settings TEST dictionary.

References

Affected packages

PyPI / django

Package

Affected ranges

Type
ECOSYSTEM
Events
Introduced
1.8
Fixed
1.8.16
Introduced
1.9
Fixed
1.9.11
Introduced
1.10
Fixed
1.10.3

Affected versions

1.*

1.8
1.8.1
1.8.2
1.8.3
1.8.4
1.8.5
1.8.6
1.8.7
1.8.8
1.8.9
1.8.10
1.8.11
1.8.12
1.8.13
1.8.14
1.8.15
1.9
1.9.1
1.9.2
1.9.3
1.9.4
1.9.5
1.9.6
1.9.7
1.9.8
1.9.9
1.9.10
1.10
1.10.1
1.10.2