Ubuntu 16.04 LTS: 3089-1 High Severity: Django Arbitrary Cookies

ubuntu

September 27, 2016

Django could be made to set arbitrary cookies.

Summary

Django could be made to set arbitrary cookies.

Software Description:

- python-django: High-level Python web development framework

Details:

Sergey Bobrov discovered that Django incorrectly parsed cookies when being

used with Google Analytics. A remote attacker could possibly use this issue

to set arbitrary cookies leading to a CSRF protection bypass.

Topics Covered

security advisory high severity ubuntu cookie issue csrf django python web framework

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 16.04 LTS:
  python-django                   1.8.7-1ubuntu5.2
  python3-django                  1.8.7-1ubuntu5.2

Ubuntu 14.04 LTS:
  python-django                   1.6.1-2ubuntu0.15

Ubuntu 12.04 LTS:
  python-django                   1.3.1-4ubuntu1.21

In general, a standard system update will make all the necessary changes.