tocsin

PyPI/django CVE-2016-7401: unknown, EPSS 5.70%

The cookie parsing code in Django before 1.8.15 and 1.9.x before 1.9.10, when used on a site with Google Analytics, allows remote attackers to bypass an intended CSRF protection mechanism by setting a

Action: Upgrade django to 1.8.15 or later.

pip install django==1.8.15
pip install django==1.9.10

Affected

introducedfixedlast affected
01.8.15-
1.91.9.10-

Fixed versions

1.8.151.9.10

Sources

CVE-2016-7401 · published · modified · JSON