The cookie parsing code in Django before 1.8.15 and 1.9.x before 1.9.10, when used on a site with Google Analytics, allows remote attackers to bypass an intended CSRF protection mechanism by setting arbitrary cookies.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Ubuntu_linux | Canonical | 12.04 (including) | 12.04 (including) |
| Ubuntu_linux | Canonical | 14.04 (including) | 14.04 (including) |
| Ubuntu_linux | Canonical | 16.04 (including) | 16.04 (including) |
| Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 6 | RedHat | python-django-0:1.6.11-6.el6ost | * |
| Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 7 | RedHat | python-django-0:1.6.11-6.el7ost | * |
| Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7 | RedHat | python-django-0:1.6.11-6.el7ost | * |
| Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7 | RedHat | python-django-0:1.8.15-1.el7ost | * |
| Red Hat OpenStack Platform 8.0 (Liberty) | RedHat | python-django-0:1.8.15-1.el7ost | * |
| Red Hat OpenStack Platform 9.0 (Mitaka) | RedHat | python-django-0:1.8.15-1.el7ost | * |
| Python-django | Ubuntu | devel | * |
| Python-django | Ubuntu | precise | * |
| Python-django | Ubuntu | trusty | * |
| Python-django | Ubuntu | upstream | * |
| Python-django | Ubuntu | xenial | * |