{"title":"Django 1.10.3 release notes","version":"dev","locale":"en","docname":"releases/1.10.3","url":"/en/dev/releases/1.10.3/","canonical":"https://djangodocs.dev/en/dev/releases/1.10.3/","summary":"Django 1.10.3 fixes two security issues and several bugs in 1.10.2. When running tests with an Oracle database, Django creates a temporary database user.","html":"

Django 1.10.3 release notesLink to this heading#

\n

November 1, 2016

\n

Django 1.10.3 fixes two security issues and several bugs in 1.10.2.

\n
\n

User with hardcoded password created when running tests on OracleLink to this heading#

\n

When running tests with an Oracle database, Django creates a temporary database\nuser. In older versions, if a password isn’t manually specified in the database\nsettings TEST dictionary, a hardcoded password is used. This could allow\nan attacker with network access to the database server to connect.

\n

This user is usually dropped after the test suite completes, but not when using\nthe manage.py test --keepdb option or if the user has an active session\n(such as an attacker’s connection).

\n

A randomly generated password is now used for each test run.

\n
\n
\n

DNS rebinding vulnerability when DEBUG=TrueLink to this heading#

\n

Older versions of Django don’t validate the Host header against\nsettings.ALLOWED_HOSTS when settings.DEBUG=True. This makes them\nvulnerable to a DNS rebinding attack.

\n

While Django doesn’t ship a module that allows remote code execution, this is\nat least a cross-site scripting vector, which could be quite serious if\ndevelopers load a copy of the production database in development or connect to\nsome production services for which there’s no development instance, for\nexample. If a project uses a package like the django-debug-toolbar, then\nthe attacker could execute arbitrary SQL, which could be especially bad if the\ndevelopers connect to the database with a superuser account.

\n

settings.ALLOWED_HOSTS is now validated regardless of DEBUG. For\nconvenience, if ALLOWED_HOSTS is empty and DEBUG=True, the following\nvariations of localhost are allowed ['localhost', '127.0.0.1', '::1']. If\nyour local settings file has your production ALLOWED_HOSTS value, you must\nnow omit it to get those fallback values.

\n
\n
\n

BugfixesLink to this heading#

\n\n
","rootId":"django-1-10-3-release-notes","toc":[{"title":"User with hardcoded password created when running tests on Oracle","anchor":"user-with-hardcoded-password-created-when-running-tests-on-oracle","children":[]},{"title":"DNS rebinding vulnerability when DEBUG=True","anchor":"dns-rebinding-vulnerability-when-debug-true","children":[]},{"title":"Bugfixes","anchor":"bugfixes","children":[]}],"breadcrumbs":[{"docname":"releases/index","title":"Release notes","url":"/en/dev/releases/"}],"prev":{"docname":"releases/1.10.4","title":"Django 1.10.4 release notes","url":"/en/dev/releases/1.10.4/"},"next":{"docname":"releases/1.10.2","title":"Django 1.10.2 release notes","url":"/en/dev/releases/1.10.2/"},"formats":{"html":"/en/dev/releases/1.10.3/","markdown":"/en/dev/releases/1.10.3.md","json":"/en/dev/releases/1.10.3.json"},"source":"https://github.com/django/django/blob/main/docs/releases/1.10.3.txt","official":"https://docs.djangoproject.com/en/dev/releases/1.10.3/","inVersions":["dev","6.1","6.0","5.2","5.1","5.0","4.2","4.1","4.0","3.2","3.1","3.0","2.2","2.1","2.0","1.11","1.10"],"inLocales":["en"]}