{"id":"CVE-2016-7401","aliases":["DEBIAN-CVE-2016-7401","DLA-649-1","DSA-3678-1","EUVD-2016-0009","GHSA-crhm-qpjc-cm64","MGASA-2016-0334","PYSEC-2016-3","RHSA-2016:2038","RHSA-2016:2039","RHSA-2016:2040","RHSA-2016:2041","RHSA-2016:2042","RHSA-2016:2043","SUSE-SU-2018:0973-1","SUSE-SU-2018:1102-1","UBUNTU-CVE-2016-7401","USN-3089-1","openSUSE-SU-2024:11205-1","openSUSE-SU-2024:11333-1","openSUSE-SU-2024:12248-1","openSUSE-SU-2024:13158-1","openSUSE-SU-2024:13887-1","openSUSE-SU-2024:14073-1","openSUSE-SU-2024:14208-1","openSUSE-SU-2025:14741-1","openSUSE-SU-2026:10005-1","openSUSE-SU-2026:10349-1","openSUSE-SU-2026:11235-1","openSUSE-SU-2026:11248-1","openSUSE-SU-2026:11270-1"],"status":"published","title":"Django CSRF Protection Bypass","description":"The cookie parsing code in Django before 1.8.15 and 1.9.x before 1.9.10, when used on a site with Google Analytics, allows remote attackers to bypass an intended CSRF protection mechanism by setting arbitrary cookies.","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.05702,"percentile":0.93064,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-254"],"published":"2016-09-26T00:00:00Z","modified":"2026-10-24T10:30:18Z","fixes":[{"ecosystem":"PyPI","package":"django","fixed_in":["1.8.15","1.9.10"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"python-django","fixed_in":["1:1.10-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"python-django","fixed_in":["1:1.10-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"python-django","fixed_in":["1:1.10-1"],"sources":["osv"]},{"ecosystem":"Debian:7","package":"python-django","fixed_in":["1.4.22-1+deb7u1"],"sources":["osv"]},{"ecosystem":"Debian:8","package":"python-django","fixed_in":["1.7.11-1+deb8u1"],"sources":["osv"]},{"ecosystem":"Mageia:5","package":"python-django","fixed_in":["1.8.15-1.mga5"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:5::el6","package":"python-django","fixed_in":["0:1.6.11-6.el6ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:5::el6","package":"python-django-bash-completion","fixed_in":["0:1.6.11-6.el6ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:5::el6","package":"python-django-doc","fixed_in":["0:1.6.11-6.el6ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:5::el7","package":"python-django","fixed_in":["0:1.6.11-6.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:5::el7","package":"python-django-bash-completion","fixed_in":["0:1.6.11-6.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:5::el7","package":"python-django-doc","fixed_in":["0:1.6.11-6.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:6::el7","package":"python-django","fixed_in":["0:1.6.11-6.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:6::el7","package":"python-django-bash-completion","fixed_in":["0:1.6.11-6.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:6::el7","package":"python-django-doc","fixed_in":["0:1.6.11-6.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:7::el7","package":"python-django","fixed_in":["0:1.8.15-1.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:7::el7","package":"python-django-bash-completion","fixed_in":["0:1.8.15-1.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:7::el7","package":"python-django-doc","fixed_in":["0:1.8.15-1.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:8::el7","package":"python-django","fixed_in":["0:1.8.15-1.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:8::el7","package":"python-django-bash-completion","fixed_in":["0:1.8.15-1.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:9::el7","package":"python-django","fixed_in":["0:1.8.15-1.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:9::el7","package":"python-django-bash-completion","fixed_in":["0:1.8.15-1.el7ost"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"python-django","fixed_in":["1.6.1-2ubuntu0.15"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"python-django","fixed_in":["1.8.7-1ubuntu5.2"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"rubygem-http-cookie","fixed_in":["1.0.5-1.1","1.0.6-1.1","1.0.8-1.1","1.0.8-1.3"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"ruby3.2-rubygem-http-cookie","fixed_in":["1.0.5-1.4"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.15"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.9"},{"fixed":"1.9.10"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.10-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.10-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.10-1"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.22-1+deb7u1"}]}],"versions":["1.4.22-1","1.4.5-1","1.4.5-1+deb7u1","1.4.5-1+deb7u10","1.4.5-1+deb7u11","1.4.5-1+deb7u11~bpo60+1","1.4.5-1+deb7u12","1.4.5-1+deb7u13","1.4.5-1+deb7u13~bpo60+1","1.4.5-1+deb7u14","1.4.5-1+deb7u14~bpo60+1","1.4.5-1+deb7u15","1.4.5-1+deb7u16","1.4.5-1+deb7u17","1.4.5-1+deb7u2","1.4.5-1+deb7u3","1.4.5-1+deb7u4","1.4.5-1+deb7u4~bpo60+1","1.4.5-1+deb7u5","1.4.5-1+deb7u6","1.4.5-1+deb7u7","1.4.5-1+deb7u7~bpo60+1","1.4.5-1+deb7u8","1.4.5-1+deb7u8~bpo60+1","1.4.5-1+deb7u9"]},{"source":"osv","ecosystem":"Debian:8","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.11-1+deb8u1"}]}],"versions":["1.7.10-1","1.7.11-1","1.7.7-1","1.7.7-1+deb8u1","1.7.7-1+deb8u2","1.7.7-1+deb8u3","1.7.7-1+deb8u4","1.7.7-1+deb8u5","1.7.9-1"]},{"source":"osv","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.15"}]}],"versions":["1.0.1","1.0.2","1.0.3","1.0.4","1.1","1.1.1","1.1.2","1.1.3","1.1.4","1.2","1.2.1","1.2.2","1.2.3","1.2.4","1.2.5","1.2.6","1.2.7","1.3","1.3.1","1.3.2","1.3.3","1.3.4","1.3.5","1.3.6","1.3.7","1.4","1.4.1","1.4.10","1.4.11","1.4.12","1.4.13","1.4.14","1.4.15","1.4.16","1.4.17","1.4.18","1.4.19","1.4.2","1.4.20","1.4.21","1.4.22","1.4.3","1.4.4","1.4.5","1.4.6","1.4.7","1.4.8","1.4.9","1.5","1.5.1","1.5.10","1.5.11","1.5.12","1.5.2","1.5.3","1.5.4","1.5.5","1.5.6","1.5.7","1.5.8","1.5.9","1.6","1.6.1","1.6.10","1.6.11","1.6.2","1.6.3","1.6.4","1.6.5","1.6.6","1.6.7","1.6.8","1.6.9","1.7","1.7.1","1.7.10","1.7.11","1.7.2","1.7.3","1.7.4","1.7.5","1.7.6","1.7.7","1.7.8","1.7.9","1.8","1.8.1","1.8.10","1.8.11","1.8.12","1.8.13","1.8.14","1.8.2","1.8.3","1.8.4","1.8.5","1.8.6","1.8.7","1.8.8","1.8.9","1.8a1","1.8b1","1.8b2","1.8c1"]},{"source":"osv","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.9"},{"fixed":"1.9.10"}]}],"versions":["1.9","1.9.1","1.9.2","1.9.3","1.9.4","1.9.5","1.9.6","1.9.7","1.9.8","1.9.9"]},{"source":"osv","ecosystem":"Mageia:5","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.15-1.mga5"}]}]},{"source":"osv","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.15"},{"introduced":"1.9"},{"fixed":"1.9.10"}]}],"versions":["1.0.1","1.0.2","1.0.3","1.0.4","1.1","1.1.1","1.1.2","1.1.3","1.1.4","1.2","1.2.1","1.2.2","1.2.3","1.2.4","1.2.5","1.2.6","1.2.7","1.3","1.3.1","1.3.2","1.3.3","1.3.4","1.3.5","1.3.6","1.3.7","1.4","1.4.1","1.4.10","1.4.11","1.4.12","1.4.13","1.4.14","1.4.15","1.4.16","1.4.17","1.4.18","1.4.19","1.4.2","1.4.20","1.4.21","1.4.22","1.4.3","1.4.4","1.4.5","1.4.6","1.4.7","1.4.8","1.4.9","1.5","1.5.1","1.5.10","1.5.11","1.5.12","1.5.2","1.5.3","1.5.4","1.5.5","1.5.6","1.5.7","1.5.8","1.5.9","1.6","1.6.1","1.6.10","1.6.11","1.6.2","1.6.3","1.6.4","1.6.5","1.6.6","1.6.7","1.6.8","1.6.9","1.7","1.7.1","1.7.10","1.7.11","1.7.2","1.7.3","1.7.4","1.7.5","1.7.6","1.7.7","1.7.8","1.7.9","1.8","1.8.1","1.8.10","1.8.11","1.8.12","1.8.13","1.8.14","1.8.2","1.8.3","1.8.4","1.8.5","1.8.6","1.8.7","1.8.8","1.8.9","1.8a1","1.8b1","1.8b2","1.8c1","1.9","1.9.1","1.9.2","1.9.3","1.9.4","1.9.5","1.9.6","1.9.7","1.9.8","1.9.9"]},{"source":"osv","ecosystem":"Red Hat:openstack:5::el6","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-6.el6ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:5::el6","package":"python-django-bash-completion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-6.el6ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:5::el6","package":"python-django-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-6.el6ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:5::el7","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-6.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:5::el7","package":"python-django-bash-completion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-6.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:5::el7","package":"python-django-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-6.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:6::el7","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-6.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:6::el7","package":"python-django-bash-completion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-6.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:6::el7","package":"python-django-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-6.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:7::el7","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.15-1.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:7::el7","package":"python-django-bash-completion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.15-1.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:7::el7","package":"python-django-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.15-1.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:8::el7","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.15-1.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:8::el7","package":"python-django-bash-completion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.15-1.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:9::el7","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.15-1.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:9::el7","package":"python-django-bash-completion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.15-1.el7ost"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"python-Django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.19-3.4.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 6","package":"python-Django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.19-3.6.1"}]}],"bundled":9},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-2ubuntu0.15"}]}],"versions":["1.5.4-1ubuntu1","1.6-1","1.6.1-1","1.6.1-2","1.6.1-2ubuntu0.1","1.6.1-2ubuntu0.2","1.6.1-2ubuntu0.3","1.6.1-2ubuntu0.4","1.6.1-2ubuntu0.5","1.6.1-2ubuntu0.6","1.6.1-2ubuntu0.8","1.6.1-2ubuntu0.9","1.6.1-2ubuntu0.10","1.6.1-2ubuntu0.11","1.6.1-2ubuntu0.12","1.6.1-2ubuntu0.13","1.6.1-2ubuntu0.14"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.7-1ubuntu5.2"}]}],"versions":["1.7.9-1ubuntu5","1.8.5-2ubuntu1","1.8.7-1ubuntu1","1.8.7-1ubuntu2","1.8.7-1ubuntu3","1.8.7-1ubuntu4","1.8.7-1ubuntu5","1.8.7-1ubuntu5.1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-2ubuntu0.15"}]}],"versions":["1.5.4-1ubuntu1","1.6-1","1.6.1-1","1.6.1-2","1.6.1-2ubuntu0.1","1.6.1-2ubuntu0.2","1.6.1-2ubuntu0.3","1.6.1-2ubuntu0.4","1.6.1-2ubuntu0.5","1.6.1-2ubuntu0.6","1.6.1-2ubuntu0.8","1.6.1-2ubuntu0.9","1.6.1-2ubuntu0.10","1.6.1-2ubuntu0.11","1.6.1-2ubuntu0.12","1.6.1-2ubuntu0.13","1.6.1-2ubuntu0.14"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.7-1ubuntu5.2"}]}],"versions":["1.7.9-1ubuntu5","1.8.5-2ubuntu1","1.8.7-1ubuntu1","1.8.7-1ubuntu2","1.8.7-1ubuntu3","1.8.7-1ubuntu4","1.8.7-1ubuntu5","1.8.7-1ubuntu5.1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-Django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.7-2.3"}]}],"bundled":30},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rubygem-http-cookie","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.5-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"ruby3.2-rubygem-http-cookie","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.5-1.4"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-Django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.11-2.1"}]}],"bundled":30},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rubygem-http-cookie","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-Django4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.14-1.1"}]}],"bundled":51},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rubygem-http-cookie","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.8-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-Django6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-1.1"}]}],"bundled":70},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rubygem-http-cookie","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.8-1.3"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-Django4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.30-4.1"}]}],"bundled":59},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-Django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.16-1.1"}]}],"bundled":49},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-Django5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.16-1.1"}]}],"bundled":93}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"debian","product":"debian_linux"},{"vendor":"djangoproject","product":"django"}],"references":[{"url":"http://www.debian.org/security/2016/dsa-3678","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2016-2040.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2016-2043.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"http://www.securitytracker.com/id/1036899","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Third Party Advisory","advisory","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2016-2041.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"https://www.djangoproject.com/weblog/2016/sep/26/security-releases/","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","fix","web","article","report"]},{"url":"http://rhn.redhat.com/errata/RHSA-2016-2042.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"http://www.ubuntu.com/usn/USN-3089-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory","web"]},{"url":"http://www.securityfocus.com/bid/93182","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","advisory","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2016-2038.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2016-2039.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-7401","tags":["advisory"]},{"url":"https://web.archive.org/web/20200227223637/http://www.securityfocus.com/bid/93182","tags":["web"]},{"url":"https://web.archive.org/web/20210927195154/http://www.securitytracker.com/id/1036899","tags":["web"]},{"url":"https://github.com/django/django/commit/6fe846a8f08dc959003f298b5407e321c6fe3735","tags":["web"]},{"url":"https://github.com/django/django/commit/6118ab7d0676f0d622278e5be215f14fb5410b6a","tags":["web"]},{"url":"https://github.com/django/django/commit/d1bc980db1c0fffd6d60677e62f70beadb9fe64a","tags":["web"]},{"url":"https://www.djangoproject.com/weblog/2016/sep/26/security-releases","tags":["web"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2016-3.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-crhm-qpjc-cm64","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2016-7401","tags":["advisory"]},{"url":"https://github.com/django/django","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2016-0334.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=19464","tags":["report"]},{"url":"https://access.redhat.com/errata/RHSA-2016:2038","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1377376","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_2038.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-7401","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-7401","tags":["advisory","report"]},{"url":"https://access.redhat.com/errata/RHSA-2016:2039","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_2039.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2016:2040","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_2040.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2016:2041","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_2041.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2016:2042","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_2042.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2016:2043","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_2043.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20180973-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1001374","tags":["report"]},{"url":"https://bugzilla.suse.com/1008047","tags":["report"]},{"url":"https://bugzilla.suse.com/1008050","tags":["report"]},{"url":"https://bugzilla.suse.com/1031450","tags":["report"]},{"url":"https://bugzilla.suse.com/1031451","tags":["report"]},{"url":"https://bugzilla.suse.com/1056284","tags":["report"]},{"url":"https://bugzilla.suse.com/1083304","tags":["report"]},{"url":"https://bugzilla.suse.com/1083305","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7401","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9013","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9014","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-12794","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7233","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7234","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7536","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7537","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20181102-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/967999","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2512","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2016-7401","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3089-1","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3982","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5145","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5963","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16984","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-6188","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11358","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12308","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12781","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14232","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-19118","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-19844","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-3498","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-6975","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13254","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13596","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-24583","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-24584","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-7471","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-9402","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-31542","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-32052","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-33203","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-33571","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-35042","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-45115","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-45452","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-22818","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-23833","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-28346","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-28347","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-34265","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-36359","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-41323","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-23969","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-24580","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-31047","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-36053","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-41164","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-43665","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-24680","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27351","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-38875","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-39329","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-39330","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-39614","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-41989","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-41990","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-41991","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42005","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45230","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45231","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53907","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53908","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56374","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-13372","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-26699","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-27556","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-32873","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-48432","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-57833","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59681","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59682","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-64459","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-64460","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48588","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53877","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53878","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-13473","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-14550","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-1207","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-1285","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-1287","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-1312","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25674","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33033","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33034","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-35192","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-35193","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-3902","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-4277","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-4292","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48587","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-5766","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6873","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6907","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-7666","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8404","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2016-7401","description":"The cookie parsing code in Django before 1.8.15 and 1.9.x before 1.9.10, when used on a site with Google Analytics, allows remote attackers to bypass an intended CSRF protection mechanism by setting arbitrary cookies.","status":"published","published":"2016-10-03T18:00:00Z","modified":"2024-08-06T01:57:47.529Z","updated_at":"2026-11-02T14:33:36.483151Z"}],"euvd":[{"id":"EUVD-2016-0009","description":"The cookie parsing code in Django before 1.8.15 and 1.9.x before 1.9.10, when used on a site with Google Analytics, allows remote attackers to bypass an intended CSRF protection mechanism by setting arbitrary cookies.","status":"published","published":"2016-10-03T18:00:00Z","modified":"2024-08-06T01:57:47Z","updated_at":"2026-11-03T02:22:33.482405Z"}],"ghsa":[{"id":"GHSA-crhm-qpjc-cm64","title":"Django CSRF Protection Bypass","description":"The cookie parsing code in Django before 1.8.15 and 1.9.x before 1.9.10, when used on a site with Google Analytics, allows remote attackers to bypass an intended CSRF protection mechanism by setting arbitrary cookies.","status":"published","published":"2022-05-14T03:55:50Z","modified":"2024-09-18T16:16:34Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"},{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T14:38:03.800952Z"}],"nvd":[{"id":"CVE-2016-7401","description":"The cookie parsing code in Django before 1.8.15 and 1.9.x before 1.9.10, when used on a site with Google Analytics, allows remote attackers to bypass an intended CSRF protection mechanism by setting arbitrary cookies.","status":"published","published":"2016-10-03T18:59:13.137Z","modified":"2026-06-17T00:52:59.777Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-254"],"updated_at":"2026-11-02T14:03:31.485755Z"}],"osv":[{"id":"CVE-2016-7401","description":"The cookie parsing code in Django before 1.8.15 and 1.9.x before 1.9.10, when used on a site with Google Analytics, allows remote attackers to bypass an intended CSRF protection mechanism by setting arbitrary cookies.","status":"published","published":"2016-10-03T18:59:13.137Z","modified":"2026-10-24T10:30:18.773476644Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:02.776224Z"},{"id":"DEBIAN-CVE-2016-7401","description":"The cookie parsing code in Django before 1.8.15 and 1.9.x before 1.9.10, when used on a site with Google Analytics, allows remote attackers to bypass an intended CSRF protection mechanism by setting arbitrary cookies.","status":"published","published":"2016-10-03T18:59:13.137Z","modified":"2026-09-22T07:03:11.512538548Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:27.910042Z"},{"id":"GHSA-crhm-qpjc-cm64","title":"Django CSRF Protection Bypass","description":"The cookie parsing code in Django before 1.8.15 and 1.9.x before 1.9.10, when used on a site with Google Analytics, allows remote attackers to bypass an intended CSRF protection mechanism by setting arbitrary cookies.","status":"published","published":"2022-05-14T03:55:50Z","modified":"2024-11-28T05:41:24.301301Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"},{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T15:46:45.28161Z"},{"id":"RHSA-2016:2038","title":"Red Hat Security Advisory: python-django security update","status":"published","published":"2024-09-13T14:37:01Z","modified":"2026-06-29T10:13:53Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:03.734507Z"},{"id":"RHSA-2016:2039","title":"Red Hat Security Advisory: python-django security update","status":"published","published":"2024-09-13T14:37:06Z","modified":"2026-06-29T10:13:54Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:03.734507Z"},{"id":"RHSA-2016:2040","title":"Red Hat Security Advisory: python-django security update","status":"published","published":"2024-09-13T14:37:12Z","modified":"2026-06-29T10:13:54Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:03.734507Z"},{"id":"RHSA-2016:2041","title":"Red Hat Security Advisory: python-django security update","status":"published","published":"2024-09-13T14:37:16Z","modified":"2026-06-29T10:13:55Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:03.734507Z"},{"id":"RHSA-2016:2042","title":"Red Hat Security Advisory: python-django security update","status":"published","published":"2024-09-13T14:37:22Z","modified":"2026-06-29T10:13:55Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:03.734507Z"},{"id":"RHSA-2016:2043","title":"Red Hat Security Advisory: python-django security update","status":"published","published":"2024-09-13T14:37:27Z","modified":"2026-06-29T10:13:55Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:03.734507Z"},{"id":"UBUNTU-CVE-2016-7401","description":"The cookie parsing code in Django before 1.8.15 and 1.9.x before 1.9.10, when used on a site with Google Analytics, allows remote attackers to bypass an intended CSRF protection mechanism by setting arbitrary cookies.","status":"published","published":"2016-09-26T18:00:00Z","modified":"2026-02-04T03:24:19.500666Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:54:12.994319Z"},{"id":"DLA-649-1","title":"python-django - security update","status":"published","published":"2016-10-06T00:00:00Z","modified":"2026-03-09T02:10:11.453706Z","updated_at":"2026-11-02T15:46:13.207219Z"},{"id":"DSA-3678-1","title":"python-django - security update","status":"published","published":"2016-09-26T00:00:00Z","modified":"2026-03-09T01:19:13.6394Z","updated_at":"2026-11-02T15:46:16.199525Z"},{"id":"MGASA-2016-0334","title":"Updated python-django packages fix security vulnerability","description":"CVE-2016-7401: CSRF protection bypass on a site with Google Analytics\n\nAn interaction between Google Analytics and Django's cookie parsing could\nallow an attacker to set arbitrary cookies leading to a bypass of CSRF\nprotection.\n","status":"published","published":"2016-10-04T12:20:54Z","modified":"2026-04-16T06:24:48.810344059Z","updated_at":"2026-11-02T15:49:40.103088Z"},{"id":"openSUSE-SU-2024:11205-1","title":"python36-Django-3.2.7-2.3 on GA media","description":"These are all security issues fixed in the python36-Django-3.2.7-2.3 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:15:14.367485Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"openSUSE-SU-2024:11333-1","title":"ruby2.7-rubygem-http-cookie-1.0.4-1.2 on GA media","description":"These are all security issues fixed in the ruby2.7-rubygem-http-cookie-1.0.4-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2025-05-07T18:09:24.19868Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"openSUSE-SU-2024:12248-1","title":"ruby3.1-rubygem-http-cookie-1.0.5-1.1 on GA media","description":"These are all security issues fixed in the ruby3.1-rubygem-http-cookie-1.0.5-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:26:12.498899Z","updated_at":"2026-11-02T16:58:35.485255Z"},{"id":"openSUSE-SU-2024:13158-1","title":"ruby3.2-rubygem-http-cookie-1.0.5-1.4 on GA media","description":"These are all security issues fixed in the ruby3.2-rubygem-http-cookie-1.0.5-1.4 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:48:51.267778Z","updated_at":"2026-11-02T16:58:36.025801Z"},{"id":"openSUSE-SU-2024:13887-1","title":"python310-Django-4.2.11-2.1 on GA media","description":"These are all security issues fixed in the python310-Django-4.2.11-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:50:27.577316Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"openSUSE-SU-2024:14073-1","title":"ruby3.3-rubygem-http-cookie-1.0.6-1.1 on GA media","description":"These are all security issues fixed in the ruby3.3-rubygem-http-cookie-1.0.6-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-24T00:00:00Z","modified":"2026-02-04T03:03:47.429489Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"openSUSE-SU-2024:14208-1","title":"python310-Django4-4.2.14-1.1 on GA media","description":"These are all security issues fixed in the python310-Django4-4.2.14-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-07-19T00:00:00Z","modified":"2026-02-04T02:20:42.476564Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"openSUSE-SU-2025:14741-1","title":"ruby3.4-rubygem-http-cookie-1.0.8-1.1 on GA media","description":"These are all security issues fixed in the ruby3.4-rubygem-http-cookie-1.0.8-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-02-06T00:00:00Z","modified":"2026-02-04T03:20:07.897083Z","updated_at":"2026-11-02T16:58:36.976155Z"},{"id":"openSUSE-SU-2026:10005-1","title":"python312-Django6-6.0-1.1 on GA media","description":"These are all security issues fixed in the python312-Django6-6.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-01-03T00:00:00Z","modified":"2026-03-23T04:54:19.792844Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"openSUSE-SU-2026:10349-1","title":"ruby4.0-rubygem-http-cookie-1.0.8-1.3 on GA media","description":"These are all security issues fixed in the ruby4.0-rubygem-http-cookie-1.0.8-1.3 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-03-13T00:00:00Z","modified":"2026-03-14T08:44:10.424179Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"openSUSE-SU-2026:11235-1","title":"python313-Django4-4.2.30-4.1 on GA media","description":"These are all security issues fixed in the python313-Django4-4.2.30-4.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-07-09T00:00:00Z","modified":"2026-07-10T10:00:10.244458214Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:11248-1","title":"python313-Django-5.2.16-1.1 on GA media","description":"These are all security issues fixed in the python313-Django-5.2.16-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-07-10T00:00:00Z","modified":"2026-07-11T09:15:07.179829219Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:11270-1","title":"python313-Django5-5.2.16-1.1 on GA media","description":"These are all security issues fixed in the python313-Django5-5.2.16-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-07-14T00:00:00Z","modified":"2026-07-15T10:00:11.454078308Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"PYSEC-2016-3","description":"The cookie parsing code in Django before 1.8.15 and 1.9.x before 1.9.10, when used on a site with Google Analytics, allows remote attackers to bypass an intended CSRF protection mechanism by setting arbitrary cookies.","status":"published","published":"2016-10-03T18:59:00Z","modified":"2026-06-10T17:01:01.849419464Z","updated_at":"2026-11-02T15:52:51.645172Z"},{"id":"SUSE-SU-2018:0973-1","title":"Security update for python-Django","description":"This update for python-Django fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2018-7537: Fixed catastrophic backtracking in django.utils.text.Truncator. (bsc#1083305)\n- CVE-2018-7536: Fixed catastrophic backtracking in urlize and urlizetrunc template filters. (bsc#1083304)\n- CVE-2017-12794: Fixed XSS possibility in traceback section of technical 500 debug page (bsc#1056284)\n- CVE-2017-7234: Open redirect vulnerability in django.views.static.serve() (bsc#1031451)\n- CVE-2017-7233: Open redirect and possible XSS attack via user-supplied numeric redirect URLs (bsc#1031450)\n- CVE-2016-9014: DNS rebinding vulnerability when DEBUG=True (bsc#1008047)\n- CVE-2016-9013: User with hardcoded password created when running tests on Oracle (bsc#1008050)\n- CVE-2016-7401: CSRF protection bypass on a site with Google Analytics (bsc#1001374)\n","status":"published","published":"2018-04-18T06:31:23Z","modified":"2026-02-04T03:21:17.825683Z","updated_at":"2026-11-02T15:53:44.594517Z"},{"id":"SUSE-SU-2018:1102-1","title":"Security update for python-Django","description":"This update for python-Django fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2018-7537: Fixed catastrophic backtracking in django.utils.text.Truncator. (bsc#1083305)\n- CVE-2018-7536: Fixed catastrophic backtracking in urlize and urlizetrunc template filters. (bsc#1083304)\n- CVE-2017-12794: Fixed XSS possibility in traceback section of technical 500 debug page (bsc#1056284)\n- CVE-2017-7234: Open redirect vulnerability in django.views.static.serve() (bsc#1031451)\n- CVE-2017-7233: Open redirect and possible XSS attack via user-supplied numeric redirect URLs (bsc#1031450)\n- CVE-2016-9014: DNS rebinding vulnerability when DEBUG=True (bsc#1008047)\n- CVE-2016-9013: User with hardcoded password created when running tests on Oracle (bsc#1008050)\n- CVE-2016-7401: CSRF protection bypass on a site with Google Analytics (bsc#1001374)\n- CVE-2016-2512: Vulnerability in the function tils.http.is_safe_url could allow remote users to arbitrary \n                 web site and conduct phishing attacks. (bsc#bnc#967999)\n","status":"published","published":"2018-04-27T13:24:32Z","modified":"2026-02-04T03:51:17.509539Z","updated_at":"2026-11-02T15:53:44.594517Z"},{"id":"USN-3089-1","title":"python-django vulnerability","description":"Sergey Bobrov discovered that Django incorrectly parsed cookies when being\nused with Google Analytics. A remote attacker could possibly use this issue\nto set arbitrary cookies leading to a CSRF protection bypass.\n","status":"published","published":"2016-09-27T12:52:29Z","modified":"2026-02-10T04:41:02Z","updated_at":"2026-11-02T16:58:10.303275Z"}]}}