SB2016102106 - Arch Linux update for python2-django
Published: October 21, 2016
Security Bulletin ID
SB2016102106
Severity
Medium
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Data manipulation
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Insecure cookie handling (CVE-ID: CVE-2016-7401)
The vulnerability allows a remote attacker to bypass certain security restrictions.
The vulnerability exists due to interraction error between Django's cookie parsing code and Google Analytics. A remote attacker can set arbitrary cookies and bypass CSRF protection, implemented by web application.
Successful exploitation of this vulnerability may allow an attacker to bypass various website security mechanisms, based on cookies.
Remediation
Install update from vendor's website.