SB2016101029 - Red Hat Enterprise Linux OpenStack Platform 7 update for python-django
Published: October 10, 2016 Updated: April 24, 2025
Security Bulletin ID
SB2016101029
Severity
Medium
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Data manipulation
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Insecure cookie handling (CVE-ID: CVE-2016-7401)
The vulnerability allows a remote attacker to bypass certain security restrictions.
The vulnerability exists due to interraction error between Django's cookie parsing code and Google Analytics. A remote attacker can set arbitrary cookies and bypass CSRF protection, implemented by web application.
Successful exploitation of this vulnerability may allow an attacker to bypass various website security mechanisms, based on cookies.
Remediation
Install update from vendor's website.