CVE-2015-5963 Django denial of service via empty session record creation
MediumCVSS 5.0
EPSS 5.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
contrib.sessions.middleware.SessionMiddleware in Django 1.8.x before 1.8.4, 1.7.x before 1.7.10, 1.4.x before 1.4.22, and possibly other versions allows remote attackers to cause a denial of service (session store consumption or session record removal) via a large number of requests to contrib.auth.views.logout, which triggers the creation of an empty session record.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi django(PyPI) | >= 1.8, < 1.8.4 | 1.8.4 |
| pypi django(PyPI) | = 1.8 | No fix listed |
| pypi django(PyPI) | = 1.8.1 | No fix listed |
| pypi django(PyPI) | = 1.8.2 | No fix listed |
| pypi django(PyPI) | = 1.8.3 | No fix listed |
| pypi django(PyPI) | >= 1.7, < 1.7.10 | 1.7.10 |
| pypi django(PyPI) | = 1.7 | No fix listed |
| pypi django(PyPI) | = 1.7.1 | No fix listed |
| pypi django(PyPI) | = 1.7.2 | No fix listed |
| pypi django(PyPI) | = 1.7.3 | No fix listed |
| pypi django(PyPI) | = 1.7.4 | No fix listed |
| pypi django(PyPI) | = 1.7.5 | No fix listed |
| pypi django(PyPI) | = 1.7.6 | No fix listed |
| pypi django(PyPI) | = 1.7.7 | No fix listed |
| pypi django(PyPI) | = 1.7.8 | No fix listed |
| pypi django(PyPI) | = 1.7.9 | No fix listed |
| pypi django(PyPI) | >= 1.4, < 1.4.22 | 1.4.22 |
| pypi django(PyPI) | = 1.4 | No fix listed |
| pypi django(PyPI) | = 1.4.1 | No fix listed |
| pypi django(PyPI) | = 1.4.10 | No fix listed |
| pypi django(PyPI) | = 1.4.11 | No fix listed |
| pypi django(PyPI) | = 1.4.12 | No fix listed |
| pypi django(PyPI) | = 1.4.13 | No fix listed |
| pypi django(PyPI) | = 1.4.14 | No fix listed |
| pypi django(PyPI) | = 1.4.15 | No fix listed |
Show 60 more
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi django(PyPI) | = 1.4.16 | No fix listed |
| pypi django(PyPI) | = 1.4.17 | No fix listed |
| pypi django(PyPI) | = 1.4.18 | No fix listed |
| pypi django(PyPI) | = 1.4.19 | No fix listed |
| pypi django(PyPI) | = 1.4.2 | No fix listed |
| pypi django(PyPI) | = 1.4.20 | No fix listed |
| pypi django(PyPI) | = 1.4.21 | No fix listed |
| pypi django(PyPI) | = 1.4.3 | No fix listed |
| pypi django(PyPI) | = 1.4.4 | No fix listed |
| pypi django(PyPI) | = 1.4.5 | No fix listed |
| pypi django(PyPI) | = 1.4.6 | No fix listed |
| pypi django(PyPI) | = 1.4.7 | No fix listed |
| pypi django(PyPI) | = 1.4.8 | No fix listed |
| pypi django(PyPI) | = 1.4.9 | No fix listed |
| debian/python-django(Debian:12) | < 1.7.10-1 | 1.7.10-1 |
| debian/python-django(Debian:13) | < 1.7.10-1 | 1.7.10-1 |
| debian/python-django(Debian:14) | < 1.7.10-1 | 1.7.10-1 |
| djangoproject django | = 1.4 | No fix listed |
| djangoproject django | = 1.4.1 | No fix listed |
| djangoproject django | = 1.4.2 | No fix listed |
| djangoproject django | = 1.4.4 | No fix listed |
| djangoproject django | = 1.4.5 | No fix listed |
| djangoproject django | = 1.4.6 | No fix listed |
| djangoproject django | = 1.4.7 | No fix listed |
| djangoproject django | = 1.4.8 | No fix listed |
| djangoproject django | = 1.4.9 | No fix listed |
| djangoproject django | = 1.4.10 | No fix listed |
| djangoproject django | = 1.4.11 | No fix listed |
| djangoproject django | = 1.4.12 | No fix listed |
| djangoproject django | = 1.4.13 | No fix listed |
| djangoproject django | = 1.4.14 | No fix listed |
| djangoproject django | = 1.4.17 | No fix listed |
| djangoproject django | = 1.4.19 | No fix listed |
| djangoproject django | = 1.4.20 | No fix listed |
| djangoproject django | = 1.4.21 | No fix listed |
| djangoproject django | = 1.7-beta1 | No fix listed |
| djangoproject django | = 1.7-beta2 | No fix listed |
| djangoproject django | = 1.7-beta3 | No fix listed |
| djangoproject django | = 1.7-beta4 | No fix listed |
| djangoproject django | = 1.7-rc1 | No fix listed |
| djangoproject django | = 1.7-rc2 | No fix listed |
| djangoproject django | = 1.7-rc3 | No fix listed |
| djangoproject django | = 1.7.1 | No fix listed |
| djangoproject django | = 1.7.2 | No fix listed |
| djangoproject django | = 1.7.3 | No fix listed |
| djangoproject django | = 1.7.4 | No fix listed |
| djangoproject django | = 1.7.5 | No fix listed |
| djangoproject django | = 1.7.6 | No fix listed |
| djangoproject django | = 1.7.7 | No fix listed |
| djangoproject django | = 1.7.8 | No fix listed |
| djangoproject django | = 1.7.9 | No fix listed |
| djangoproject django | = 1.8-beta1 | No fix listed |
| djangoproject django | = 1.8.0 | No fix listed |
| djangoproject django | = 1.8.1 | No fix listed |
| djangoproject django | = 1.8.2 | No fix listed |
| djangoproject django | = 1.8.3 | No fix listed |
| oracle solaris | = 11.3 | No fix listed |
| Canonical Ubuntu Linux | = 12.04 | No fix listed |
| Canonical Ubuntu Linux | = 14.04 | No fix listed |
| Canonical Ubuntu Linux | = 15.04 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- github.com patch
- github.com patch
- github.com patch
- RHSA-2015:1876 vendor-advisory
- github.com product
- github.com
- github.com
- web.archive.org
- web.archive.org
- www.djangoproject.com patch technical-description vendor-advisory
- FEDORA-2015-1dd5bc998f vendor-advisory
- openSUSE-SU-2015:1580 vendor-advisory
- openSUSE-SU-2015:1598 vendor-advisory
- RHSA-2015:1766 vendor-advisory
- RHSA-2015:1767 vendor-advisory
- RHSA-2015:1894 vendor-advisory
- DSA-3338 vendor-advisory
- www.oracle.com third-party-advisory
- USN-2720-1 third-party-advisory vendor-advisory
- 76428 vdb-entry
- 1033318 vdb-entry
- github.com vendor-advisory
- Debian Security Tracker CVE-2015-5963 vendor-advisory
- bugs.debian.org issue-tracking