CVE-2016-7401

The cookie parsing code in Django before 1.8.15 and 1.9.x before 1.9.10, when used on a site with Google Analytics, allows remote attackers to bypass an intended CSRF protection mechanism by setting arbitrary cookies.

The cookie parsing code in Django before 1.8.15 and 1.9.x before 1.9.10, when used on a site with Google Analytics, allows remote attackers to bypass an intended CSRF protection mechanism by setting arbitrary cookies.

CVE-2016-7401: CSRF protection bypass on a site with Google Analytics

An interaction between Google Analytics and Django's cookie parsing could allow an attacker to set arbitrary cookies leading to a bypass of CSRF protection.

These are all security issues fixed in the python36-Django-3.2.7-2.3 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the ruby2.7-rubygem-http-cookie-1.0.4-1.2 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the ruby3.1-rubygem-http-cookie-1.0.5-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the ruby3.2-rubygem-http-cookie-1.0.5-1.4 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python310-Django-4.2.11-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the ruby3.3-rubygem-http-cookie-1.0.6-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python310-Django4-4.2.14-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the ruby3.4-rubygem-http-cookie-1.0.8-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python312-Django6-6.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the ruby4.0-rubygem-http-cookie-1.0.8-1.3 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python313-Django4-4.2.30-4.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python313-Django-5.2.16-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python313-Django5-5.2.16-1.1 package on the GA media of openSUSE Tumbleweed.

The cookie parsing code in Django before 1.8.15 and 1.9.x before 1.9.10, when used on a site with Google Analytics, allows remote attackers to bypass an intended CSRF protection mechanism by setting arbitrary cookies.

This update for python-Django fixes the following issues:

Security issues fixed:

• CVE-2018-7537: Fixed catastrophic backtracking in django.utils.text.Truncator. (bsc#1083305)
• CVE-2018-7536: Fixed catastrophic backtracking in urlize and urlizetrunc template filters. (bsc#1083304)
• CVE-2017-12794: Fixed XSS possibility in traceback section of technical 500 debug page (bsc#1056284)
• CVE-2017-7234: Open redirect vulnerability in django.views.static.serve() (bsc#1031451)
• CVE-2017-7233: Open redirect and possible XSS attack via user-supplied numeric redirect URLs (bsc#1031450)
• CVE-2016-9014: DNS rebinding vulnerability when DEBUG=True (bsc#1008047)
• CVE-2016-9013: User with hardcoded password created when running tests on Oracle (bsc#1008050)
• CVE-2016-7401: CSRF protection bypass on a site with Google Analytics (bsc#1001374)

This update for python-Django fixes the following issues:

Security issues fixed:

• CVE-2018-7537: Fixed catastrophic backtracking in django.utils.text.Truncator. (bsc#1083305)
• CVE-2018-7536: Fixed catastrophic backtracking in urlize and urlizetrunc template filters. (bsc#1083304)
• CVE-2017-12794: Fixed XSS possibility in traceback section of technical 500 debug page (bsc#1056284)
• CVE-2017-7234: Open redirect vulnerability in django.views.static.serve() (bsc#1031451)
• CVE-2017-7233: Open redirect and possible XSS attack via user-supplied numeric redirect URLs (bsc#1031450)
• CVE-2016-9014: DNS rebinding vulnerability when DEBUG=True (bsc#1008047)
• CVE-2016-9013: User with hardcoded password created when running tests on Oracle (bsc#1008050)
• CVE-2016-7401: CSRF protection bypass on a site with Google Analytics (bsc#1001374)
• CVE-2016-2512: Vulnerability in the function tils.http.is_safe_url could allow remote users to arbitrary web site and conduct phishing attacks. (bsc#bnc#967999)

Sergey Bobrov discovered that Django incorrectly parsed cookies when being used with Google Analytics. A remote attacker could possibly use this issue to set arbitrary cookies leading to a CSRF protection bypass.