CVE-2016-9013

Impact:
Moderate
Public Date:
2016-11-01
CWE:
CWE-798
Bugzilla:
1389414: CVE-2016-9013 python-django: user with hardcoded password created when running tests on Oracle

The MITRE CVE dictionary describes this issue as:

Django 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3 use a hardcoded password for a temporary database user created when running tests with an Oracle database, which makes it easier for remote attackers to obtain access to the database server by leveraging failure to manually specify a password in the database settings TEST dictionary.

Find out more about CVE-2016-9013 from the MITRE CVE dictionary dictionary and NIST NVD.

CVSS v2 metrics

NOTE: The following CVSS v2 metrics and score provided are preliminary and subject to review.

Base Score 4
Base Metrics AV:N/AC:H/Au:N/C:P/I:P/A:N
Access Vector Network
Access Complexity High
Authentication None
Confidentiality Impact Partial
Integrity Impact Partial
Availability Impact None

CVSS v3 metrics

NOTE: The following CVSS v3 metrics and score provided are preliminary and subject to review.

CVSS3 Base Score 7.4
CVSS3 Base Metrics CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack Vector Network
Attack Complexity High
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality High
Integrity Impact High
Availability Impact None

Find out more about Red Hat support for the Common Vulnerability Scoring System (CVSS).

Affected Packages State

Platform Package State
Red Hat Subscription Asset Manager 1 Django Will not fix
Red Hat Storage Console 2 python-django Not affected
Red Hat Storage Console 2 Django Not affected
Red Hat OpenStack Platform Operational Tools 9 python-django Not affected
Red Hat OpenStack Platform 9.0 python-django Not affected
Red Hat OpenStack Platform 8.0 (Liberty) python-django Not affected
Red Hat OpenStack Platform 10.0 Operational Tools for RHEL 7 python-django Not affected
Red Hat OpenStack Platform 10 python-django Not affected
Red Hat Enterprise Linux OpenStack Platform 8.0 Operational Tools for RHEL 7 python-django Not affected
Red Hat Enterprise Linux OpenStack Platform 7.0 Operational Tools for RHEL 7 python-django Not affected
Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7 python-django Not affected
Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7 python-django Not affected
Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) python-django Not affected
Red Hat Ceph Storage 2 Django Not affected
Red Hat Ceph Storage 1.3 Django Not affected

Acknowledgements

Red Hat would like to thank the Django project for reporting this issue.
Last Modified

CVE description copyright © 2017, The MITRE Corporation