CVE-2016-9014 log

Severity High
Remote Yes
Type Access restriction bypass
Older versions of Django don't validate the Host header against settings.ALLOWED_HOSTS when settings.DEBUG=True. This makes them vulnerable to a DNS rebinding attack.

While Django doesn't ship a module that allows remote code execution, this is at least a cross-site scripting vector, which could be quite serious if developers load a copy of the production database in development or connect to some production services for which there's no development instance, for example. If a project uses a package like the django-debug-toolbar, then the attacker could execute arbitrary SQL, which could be especially bad if the developers connect to the database with a superuser account.

settings.ALLOWED_HOSTS is now validated regardless of DEBUG. For convenience, if ALLOWED_HOSTS is empty and DEBUG=True, the following variations of localhost are allowed ['localhost', '', '::1']. If your local settings file has your production ALLOWED_HOSTS value, you must now omit it to get those fallback values.
Group Package Affected Fixed Severity Status Ticket
AVG-57 python-django, python2-django 1.10.2-1 1.10.3-1 High Fixed
Date Advisory Group Package Severity Type
16 Nov 2016 ASA-201611-15 AVG-57 python-django High multiple issues
16 Nov 2016 ASA-201611-14 AVG-57 python2-django High multiple issues