{"title":"Django 1.9.11 release notes","version":"dev","locale":"en","docname":"releases/1.9.11","url":"/en/dev/releases/1.9.11/","canonical":"https://djangodocs.dev/en/dev/releases/1.9.11/","summary":"Django 1.9.11 fixes two security issues in 1.9.10. When running tests with an Oracle database, Django creates a temporary database user.","html":"<h1>Django 1.9.11 release notes<a class=\"heading-anchor\" href=\"#django-1-9-11-release-notes\"><span class=\"visually-hidden\">Link to this heading</span><span aria-hidden=\"true\">#</span></a></h1>\n<p><em>November 1, 2016</em></p>\n<p>Django 1.9.11 fixes two security issues in 1.9.10.</p>\n<section id=\"user-with-hardcoded-password-created-when-running-tests-on-oracle\">\n<h2>User with hardcoded password created when running tests on Oracle<a class=\"heading-anchor\" href=\"#user-with-hardcoded-password-created-when-running-tests-on-oracle\"><span class=\"visually-hidden\">Link to this heading</span><span aria-hidden=\"true\">#</span></a></h2>\n<p>When running tests with an Oracle database, Django creates a temporary database\nuser. In older versions, if a password isn’t manually specified in the database\nsettings <code class=\"docutils literal notranslate\">TEST</code> dictionary, a hardcoded password is used. This could allow\nan attacker with network access to the database server to connect.</p>\n<p>This user is usually dropped after the test suite completes, but not when using\nthe <code class=\"docutils literal notranslate\">manage.py test --keepdb</code> option or if the user has an active session\n(such as an attacker’s connection).</p>\n<p>A randomly generated password is now used for each test run.</p>\n</section>\n<section id=\"dns-rebinding-vulnerability-when-debug-true\">\n<h2>DNS rebinding vulnerability when <code class=\"docutils literal notranslate\">DEBUG=True</code><a class=\"heading-anchor\" href=\"#dns-rebinding-vulnerability-when-debug-true\"><span class=\"visually-hidden\">Link to this heading</span><span aria-hidden=\"true\">#</span></a></h2>\n<p>Older versions of Django don’t validate the <code class=\"docutils literal notranslate\">Host</code> header against\n<code class=\"docutils literal notranslate\">settings.ALLOWED_HOSTS</code> when <code class=\"docutils literal notranslate\">settings.DEBUG=True</code>. This makes them\nvulnerable to a <a class=\"reference external\" href=\"https://benmmurphy.github.io/blog/2016/07/11/rails-webconsole-dns-rebinding/\">DNS rebinding attack</a>.</p>\n<p>While Django doesn’t ship a module that allows remote code execution, this is\nat least a cross-site scripting vector, which could be quite serious if\ndevelopers load a copy of the production database in development or connect to\nsome production services for which there’s no development instance, for\nexample. If a project uses a package like the <code class=\"docutils literal notranslate\">django-debug-toolbar</code>, then\nthe attacker could execute arbitrary SQL, which could be especially bad if the\ndevelopers connect to the database with a superuser account.</p>\n<p><code class=\"docutils literal notranslate\">settings.ALLOWED_HOSTS</code> is now validated regardless of <code class=\"docutils literal notranslate\">DEBUG</code>. For\nconvenience, if <code class=\"docutils literal notranslate\">ALLOWED_HOSTS</code> is empty and <code class=\"docutils literal notranslate\">DEBUG=True</code>, the following\nvariations of localhost are allowed <code class=\"docutils literal notranslate\">['localhost', '127.0.0.1', '::1']</code>. If\nyour local settings file has your production <code class=\"docutils literal notranslate\">ALLOWED_HOSTS</code> value, you must\nnow omit it to get those fallback values.</p>\n</section>","rootId":"django-1-9-11-release-notes","toc":[{"title":"User with hardcoded password created when running tests on Oracle","anchor":"user-with-hardcoded-password-created-when-running-tests-on-oracle","children":[]},{"title":"DNS rebinding vulnerability when DEBUG=True","anchor":"dns-rebinding-vulnerability-when-debug-true","children":[]}],"breadcrumbs":[{"docname":"releases/index","title":"Release notes","url":"/en/dev/releases/"}],"prev":{"docname":"releases/1.9.12","title":"Django 1.9.12 release notes","url":"/en/dev/releases/1.9.12/"},"next":{"docname":"releases/1.9.10","title":"Django 1.9.10 release notes","url":"/en/dev/releases/1.9.10/"},"formats":{"html":"/en/dev/releases/1.9.11/","markdown":"/en/dev/releases/1.9.11.md","json":"/en/dev/releases/1.9.11.json"},"source":"https://github.com/django/django/blob/main/docs/releases/1.9.11.txt","official":"https://docs.djangoproject.com/en/dev/releases/1.9.11/","inVersions":["dev","6.1","6.0","5.2","5.1","5.0","4.2","4.1","4.0","3.2","3.1","3.0","2.2","2.1","2.0","1.11","1.10","1.9"],"inLocales":["en"]}