CVE-2015-5963
Fixed in a distro release EPSS 5%
contrib.sessions.middleware.SessionMiddleware in Django 1.8.x before 1.8.4, 1.7.x before 1.7.10, 1.4.x before 1.4.22, and possibly other versions allows remote attackers to cause a denial of service (session store consumption or session record removal) via a large number of requests to contrib.auth.views.logout, which triggers the creation of an empty session record.
Products: djangoproject django, oracle solaris, canonical ubuntu_linux
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | django | 1.8.4 |
| PyPI | django | 1.7.10 |
| PyPI | django | 1.4.22 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | python-django | 1.7.10-1 |
| Debian 13 | python-django | 1.7.10-1 |
| Debian 14 | python-django | 1.7.10-1 |
| Debian 6.0 | python-django | 1.2.3-3+squeeze14 |
| Debian 7 | python-django | 1.4.5-1+deb7u13 |
| Debian 8 | python-django | 1.7.7-1+deb8u2 |
| Red Hat openstack 5 | python-django | 0:1.6.11-3.el6ost |
| Red Hat openstack 5 | python-django | 0:1.6.11-3.el7ost |
| Red Hat openstack 5 | python-django-bash-completion | 0:1.6.11-3.el7ost |
| Red Hat openstack 5 | python-django-bash-completion | 0:1.6.11-3.el6ost |
| Red Hat openstack 5 | python-django-doc | 0:1.6.11-3.el7ost |
| Red Hat openstack 5 | python-django-doc | 0:1.6.11-3.el6ost |
| Red Hat openstack 6 | python-django | 0:1.6.11-3.el7ost |
| Red Hat openstack 6 | python-django-bash-completion | 0:1.6.11-3.el7ost |
| Red Hat openstack 6 | python-django-doc | 0:1.6.11-3.el7ost |
| Red Hat openstack 7 | python-django | 0:1.8.4-1.el7 |
| Red Hat openstack 7 | python-django-bash-completion | 0:1.8.4-1.el7 |
| Red Hat openstack 7 | python-django-doc | 0:1.8.4-1.el7 |
| SUSE Enterprise Storage 1.0 | python-Django | 1.6.11-8.1 |
| SUSE Enterprise Storage 2 | python-Django | 1.6.11-3.1 |
| SUSE OpenStack Cloud 5 | python-Django | 1.6.11-10.2 |
| SUSE Package Hub 12 SP1 | python-Django | 1.11.15-2.1 |
| Ubuntu 14.04 LTS | python-django | 1.6.1-2ubuntu0.10 |
| openSUSE Tumbleweed | python-Django | 4.2.11-2.1 |
| openSUSE Tumbleweed | python-Django | 3.2.7-2.3 |
| openSUSE Tumbleweed | python-Django | 1.9.12-1.1 |
| openSUSE Tumbleweed | python-Django | 5.2.16-1.1 |
| openSUSE Tumbleweed | python-Django4 | 4.2.14-1.1 |
| openSUSE Tumbleweed | python-Django4 | 4.2.30-4.1 |
| openSUSE Tumbleweed | python-Django5 | 5.2.16-1.1 |
| openSUSE Tumbleweed | python-Django6 | 6.0-1.1 |