CVE-2016-9014

Source
Severity High
Remote Yes
Type Access restriction bypass
Description
Older versions of Django don't validate the Host header against settings.ALLOWED_HOSTS when settings.DEBUG=True. This makes them vulnerable to a DNS rebinding attack.

While Django doesn't ship a module that allows remote code execution, this is at least a cross-site scripting vector, which could be quite serious if developers load a copy of the production database in development or connect to some production services for which there's no development instance, for example. If a project uses a package like the django-debug-toolbar, then the attacker could execute arbitrary SQL, which could be especially bad if the developers connect to the database with a superuser account.

settings.ALLOWED_HOSTS is now validated regardless of DEBUG. For convenience, if ALLOWED_HOSTS is empty and DEBUG=True, the following variations of localhost are allowed ['localhost', '127.0.0.1', '::1']. If your local settings file has your production ALLOWED_HOSTS value, you must now omit it to get those fallback values.
Group Package Affected Fixed Severity Status Ticket
AVG-57 python-django, python2-django 1.10.2-1 1.10.3-1 High Fixed
Date Advisory Group Package Severity Description
16 Nov 2016 ASA-201611-15 AVG-57 python-django High multiple issues
16 Nov 2016 ASA-201611-14 AVG-57 python2-django High multiple issues
References
https://www.djangoproject.com/weblog/2016/nov/01/security-releases/