—
PYSEC-2016-3
Quick fix
PYSEC-2016-3 — django: upgrade to the fixed version with the command below.
pip install --upgrade 'django>=1.8.15'Details
The cookie parsing code in Django before 1.8.15 and 1.9.x before 1.9.10, when used on a site with Google Analytics, allows remote attackers to bypass an intended CSRF protection mechanism by setting arbitrary cookies.
Are you affected?
Enter the version of the package you're using.
Affected packages
References
- http://www.securitytracker.com/id/1036899[WEB]
- https://www.djangoproject.com/weblog/2016/sep/26/security-releases/[ARTICLE]
- http://www.debian.org/security/2016/dsa-3678[ADVISORY]
- http://www.securityfocus.com/bid/93182[WEB]
- http://www.ubuntu.com/usn/USN-3089-1[ADVISORY]
- http://rhn.redhat.com/errata/RHSA-2016-2043.html[ADVISORY]
- http://rhn.redhat.com/errata/RHSA-2016-2042.html[ADVISORY]
- http://rhn.redhat.com/errata/RHSA-2016-2041.html[ADVISORY]
- http://rhn.redhat.com/errata/RHSA-2016-2040.html[ADVISORY]
- http://rhn.redhat.com/errata/RHSA-2016-2039.html[ADVISORY]
- http://rhn.redhat.com/errata/RHSA-2016-2038.html[ADVISORY]
- https://github.com/advisories/GHSA-crhm-qpjc-cm64[ADVISORY]