Skip to content
OpenAdvisories
High USN-3089-1 1 CVE

python-django vulnerability

Published Sep 27, 2016 · Updated Feb 10, 2026

Ecosystem: Ubuntu

Summary

Sergey Bobrov discovered that Django incorrectly parsed cookies when being
used with Google Analytics. A remote attacker could possibly use this issue
to set arbitrary cookies leading to a CSRF protection bypass.

Fixed packages 2

ReleasePackageFixed in
Ubuntu · 14.04 LTS 14.04:LTS python-django 1.6.1-2ubuntu0.15
Ubuntu · 16.04 LTS 16.04:LTS python-django 1.8.7-1ubuntu5.2

Vulnerabilities 1

  • High 7.5
    CVE-2016-7401

    Django CSRF Protection Bypass

    The cookie parsing code in Django before 1.8.15 and 1.9.x before 1.9.10, when used on a site with Google Analytics, allows remote attackers to bypass an intended CSRF protection mechanism by setting arbitrary cookies.

    python-django django python-django Debian Ubuntu PyPI

References

  • report
    https://ubuntu.com/security/CVE-2016-7401