CVE-2015-5143
Fixed in a distro release EPSS 7%
The session backends in Django before 1.4.21, 1.5.x through 1.6.x, 1.7.x before 1.7.9, and 1.8.x before 1.8.3 allows remote attackers to cause a denial of service (session store consumption) via multiple requests with unique session keys.
Products: djangoproject django, debian_linux, oracle solaris, canonical ubuntu_linux
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | django | 1.4.21 |
| PyPI | django | 1.7.9 |
| PyPI | django | 1.8.3 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | python-django | 1.7.9-1 |
| Debian 13 | python-django | 1.7.9-1 |
| Debian 14 | python-django | 1.7.9-1 |
| Debian 6.0 | python-django | 1.2.3-3+squeeze13 |
| Debian 7 | python-django | 1.4.5-1+deb7u12 |
| Debian 8 | python-django | 1.7.7-1+deb8u1 |
| Red Hat openstack 5 | python-django | 0:1.6.11-2.el7ost |
| Red Hat openstack 5 | python-django | 0:1.6.11-1.el6ost |
| Red Hat openstack 5 | python-django-bash-completion | 0:1.6.11-1.el6ost |
| Red Hat openstack 5 | python-django-bash-completion | 0:1.6.11-2.el7ost |
| Red Hat openstack 5 | python-django-doc | 0:1.6.11-1.el6ost |
| Red Hat openstack 5 | python-django-doc | 0:1.6.11-2.el7ost |
| Red Hat openstack 6 | python-django | 0:1.6.11-2.el7ost |
| Red Hat openstack 6 | python-django-bash-completion | 0:1.6.11-2.el7ost |
| Red Hat openstack 6 | python-django-doc | 0:1.6.11-2.el7ost |
| SUSE Enterprise Storage 1.0 | python-Django | 1.6.11-8.1 |
| SUSE Enterprise Storage 2 | python-Django | 1.6.11-3.1 |
| SUSE OpenStack Cloud 5 | python-Django | 1.6.11-10.2 |
| Ubuntu 14.04 LTS | python-django | 1.6.1-2ubuntu0.9 |