An interaction between Google Analytics and Django's cookie parsing could allow an attacker to set arbitrary cookies leading to a bypass of CSRF protection. The parser for ``request.COOKIES`` is simplified to better match the behavior of browsers and to mitigate this attack. ``request.COOKIES`` may now contain cookies that are invalid according to RFC 6265 but are possible to set via ``document.cookie``.
Acknowledgments: Name: the upstream Django project
Created Django14 tracking bugs for this issue: Affects: epel-6 [bug 1379487]
Created python-django15 tracking bugs for this issue: Affects: epel-6 [bug 1379488]
Created python-django tracking bugs for this issue: Affects: fedora-all [bug 1379486] Affects: epel-7 [bug 1379489]
Statement: This issue did not affect the versions of calamari-server as shipped with Red Hat Ceph Storage 1.3 and 2.0 as they did not include support for google analytics with Django.
Hi Eric, everything is now on QE so here are the last four: https://errata.devel.redhat.com/advisory/24936 https://errata.devel.redhat.com/advisory/24937 https://errata.devel.redhat.com/advisory/24939 https://errata.devel.redhat.com/advisory/24940
(In reply to Summer Long from comment #18) Reviewed and Approved.
This issue has been addressed in the following products: Red Hat OpenStack Platform 9.0 (Mitaka) Via RHSA-2016:2043 https://rhn.redhat.com/errata/RHSA-2016-2043.html
This issue has been addressed in the following products: Red Hat OpenStack Platform 8.0 (Liberty) Via RHSA-2016:2042 https://rhn.redhat.com/errata/RHSA-2016-2042.html
This issue has been addressed in the following products: Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 7 Via RHSA-2016:2039 https://rhn.redhat.com/errata/RHSA-2016-2039.html
This issue has been addressed in the following products: Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 6 Via RHSA-2016:2038 https://rhn.redhat.com/errata/RHSA-2016-2038.html
This issue has been addressed in the following products: Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7 Via RHSA-2016:2041 https://rhn.redhat.com/errata/RHSA-2016-2041.html
This issue has been addressed in the following products: Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7 Via RHSA-2016:2040 https://rhn.redhat.com/errata/RHSA-2016-2040.html