Description
The cookie parsing code in Django before 1.8.15 and 1.9.x before 1.9.10, when used on a site with Google Analytics, allows remote attackers to bypass an intended CSRF protection mechanism by setting arbitrary cookies.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | python-django | 1:1.10-1 | — |
| Debian 13 | python-django | 1:1.10-1 | — |
| Debian 12 | python-django | 1:1.10-1 | — |
| Debian 8 | python-django | 1.7.11-1+deb8u1 | DSA-3678-1 |
| Debian 7 | python-django | 1.4.22-1+deb7u1 | DLA-649-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | python-django | 1.8.7-1ubuntu5.2 | USN-3089-1 |
| Ubuntu 14.04 LTS | python-django | 1.6.1-2ubuntu0.15 | USN-3089-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenStack 9 | python-django +1 | 1.8.15-1.el7ost | RHSA-2016:2043 |
| Red Hat OpenStack 8 | python-django +1 | 1.8.15-1.el7ost | RHSA-2016:2042 |
| Red Hat OpenStack 7 | python-django +2 | 1.8.15-1.el7ost | RHSA-2016:2041 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenStack 6 | python-django +2 | 1.6.11-6.el7ost | RHSA-2016:2040 |
| Red Hat OpenStack 5 | python-django +2 | 1.6.11-6.el6ost | RHSA-2016:2039, RHSA-2016:2038 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE OpenStack Cloud 7 | python-Django | 1.8.19-3.4.1 | SUSE-SU-2018:0973-1 |
| SUSE OpenStack Cloud 6 | python-Django | 1.8.19-3.6.1 | SUSE-SU-2018:1102-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | python-Django | 3.2.7-2.3 | openSUSE-SU-2026:11248-1, openSUSE-SU-2024:13887-1, openSUSE-SU-2024:11205-1 |
| openSUSE Tumbleweed | python-Django4 | 4.2.14-1.1 | openSUSE-SU-2026:11235-1, openSUSE-SU-2024:14208-1 |
| openSUSE Tumbleweed | python-Django5 | 5.2.16-1.1 | openSUSE-SU-2026:11270-1 |
| openSUSE Tumbleweed | python-Django6 | 6.0-1.1 | openSUSE-SU-2026:10005-1 |
| openSUSE Tumbleweed | ruby3.2-rubygem-http-cookie | 1.0.5-1.4 | openSUSE-SU-2024:13158-1 |
| openSUSE Tumbleweed | rubygem-http-cookie | 1.0.5-1.1 | openSUSE-SU-2026:10349-1, openSUSE-SU-2025:14741-1, openSUSE-SU-2024:14073-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | django | < 1.8.15 | 1.8.15 | GHSA-crhm-qpjc-cm64 |
| PyPI | django | >= 1.9, < 1.9.10 | 1.9.10 | GHSA-crhm-qpjc-cm64 |
| PyPI | django | < 1.8.15 · >= 1.9, < 1.9.10 | 1.8.15, 1.9.10 | PYSEC-2016-3 |
Advisories 23
- openSUSE-SU-2026:11270-1 python313-Django5-5.2.16-1.1 on GA media SUSE / openSUSE Security Updates · Jul 15, 2026
- openSUSE-SU-2026:11248-1 python313-Django-5.2.16-1.1 on GA media SUSE / openSUSE Security Updates · Jul 11, 2026
- openSUSE-SU-2026:11235-1 python313-Django4-4.2.30-4.1 on GA media SUSE / openSUSE Security Updates · Jul 10, 2026
- RHSA-2016:2042 Red Hat Security Advisory: python-django security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2016:2043 Red Hat Security Advisory: python-django security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2016:2041 Red Hat Security Advisory: python-django security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2016:2039 Red Hat Security Advisory: python-django security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2016:2040 Red Hat Security Advisory: python-django security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2016:2038 Red Hat Security Advisory: python-django security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- openSUSE-SU-2026:10005-1 python312-Django6-6.0-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- openSUSE-SU-2026:10349-1 ruby4.0-rubygem-http-cookie-1.0.8-1.3 on GA media SUSE / openSUSE Security Updates · Mar 14, 2026
- DLA-649-1 python-django - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-3678-1 python-django - security update Debian Security (DSA / DLA) · Mar 9, 2026
- USN-3089-1 python-django vulnerability Ubuntu Security Notices (USN) · Feb 10, 2026
- openSUSE-SU-2024:11205-1 python36-Django-3.2.7-2.3 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2018:1102-1 Security update for python-Django SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:13887-1 python310-Django-4.2.11-2.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:13158-1 ruby3.2-rubygem-http-cookie-1.0.5-1.4 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2018:0973-1 Security update for python-Django SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2025:14741-1 ruby3.4-rubygem-http-cookie-1.0.8-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:14073-1 ruby3.3-rubygem-http-cookie-1.0.6-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:12248-1 ruby3.1-rubygem-http-cookie-1.0.5-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:14208-1 python310-Django4-4.2.14-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- DSA-3678 vendor-advisory
- RHSA-2016:2040 vendor-advisory
- RHSA-2016:2043 vendor-advisory
- 1036899 vdb-entry
- RHSA-2016:2041 vendor-advisory
- https://www.djangoproject.com/weblog/2016/sep/26/security-releases/
- RHSA-2016:2042 vendor-advisory
- USN-3089-1 vendor-advisory
- 93182 vdb-entry
- RHSA-2016:2038 vendor-advisory
- RHSA-2016:2039 vendor-advisory