d1bc980db1
This is a security fix. Backport of "refs #26158 -- rewrote http.parse_cookie() to better match browsers." 93a135d111c2569d88d65a3f4ad9e6d9ad291452 from master
19 lines
678 B
Plaintext
19 lines
678 B
Plaintext
===========================
|
|
Django 1.9.10 release notes
|
|
===========================
|
|
|
|
*September 26, 2016*
|
|
|
|
Django 1.9.10 fixes a security issue in 1.9.9.
|
|
|
|
CSRF protection bypass on a site with Google Analytics
|
|
======================================================
|
|
|
|
An interaction between Google Analytics and Django's cookie parsing could allow
|
|
an attacker to set arbitrary cookies leading to a bypass of CSRF protection.
|
|
|
|
The parser for ``request.COOKIES`` is simplified to better match the behavior
|
|
of browsers and to mitigate this attack. ``request.COOKIES`` may now contain
|
|
cookies that are invalid according to :rfc:`6265` but are possible to set via
|
|
``document.cookie``.
|