python-django: cross-site request forgery
| Package(s): | python-django | CVE #(s): | CVE-2016-7401 | ||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | September 27, 2016 | Updated: | October 24, 2016 | ||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the Debian advisory:
Sergey Bobrov discovered that cookie parsing in Django and Google Analytics interacted such a way that an attacker could set arbitrary cookies. This allows other malicious web sites to bypass the Cross-Site Request Forgery (CSRF) protections built into Django. | ||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||