SB2016092702 - Ubuntu update for Django
Published: September 27, 2016
Security Bulletin ID
SB2016092702
Severity
Medium
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Data manipulation
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Insecure cookie handling (CVE-ID: CVE-2016-7401)
The vulnerability allows a remote attacker to bypass certain security restrictions.
The vulnerability exists due to interraction error between Django's cookie parsing code and Google Analytics. A remote attacker can set arbitrary cookies and bypass CSRF protection, implemented by web application.
Successful exploitation of this vulnerability may allow an attacker to bypass various website security mechanisms, based on cookies.
Remediation
Install update from vendor's website.