Django DNS Rebinding Vulnerability
High severity
GitHub Reviewed
Published
May 17, 2022
to the GitHub Advisory Database
•
Updated Sep 18, 2024
Package
Affected versions
>= 1.8a1, < 1.8.16
>= 1.9a1, < 1.9.11
>= 1.10a1, < 1.10.3
Patched versions
1.8.16
1.9.11
1.10.3
Description
Published by the National Vulnerability Database
Dec 9, 2016
Published to the GitHub Advisory Database
May 17, 2022
Reviewed
Jul 31, 2023
Last updated
Sep 18, 2024
Credits
-
MarkLee131 Analyst
Django before 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3, when settings.DEBUG is True, allow remote attackers to conduct DNS rebinding attacks by leveraging failure to validate the HTTP Host header against settings.ALLOWED_HOSTS.
References