CVE-2015-5964
Fixed in a distro release EPSS 5%
The (1) contrib.sessions.backends.base.SessionBase.flush and (2) cache_db.SessionStore.flush functions in Django 1.7.x before 1.7.10, 1.4.x before 1.4.22, and possibly other versions create empty sessions in certain circumstances, which allows remote attackers to cause a denial of service (session store consumption) via unspecified vectors.
Products: djangoproject django, canonical ubuntu_linux, oracle solaris
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | django | 1.7.10 |
| PyPI | django | 1.4.22 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | python-django | 1.7.10-1 |
| Debian 13 | python-django | 1.7.10-1 |
| Debian 14 | python-django | 1.7.10-1 |
| Debian 6.0 | python-django | 1.2.3-3+squeeze14 |
| Debian 7 | python-django | 1.4.5-1+deb7u13 |
| Debian 8 | python-django | 1.7.7-1+deb8u2 |
| Red Hat openstack 5 | python-django | 0:1.6.11-3.el6ost |
| Red Hat openstack 5 | python-django | 0:1.6.11-3.el7ost |
| Red Hat openstack 5 | python-django-bash-completion | 0:1.6.11-3.el7ost |
| Red Hat openstack 5 | python-django-bash-completion | 0:1.6.11-3.el6ost |
| Red Hat openstack 5 | python-django-doc | 0:1.6.11-3.el6ost |
| Red Hat openstack 5 | python-django-doc | 0:1.6.11-3.el7ost |
| Red Hat openstack 6 | python-django | 0:1.6.11-3.el7ost |
| Red Hat openstack 6 | python-django-bash-completion | 0:1.6.11-3.el7ost |
| Red Hat openstack 6 | python-django-doc | 0:1.6.11-3.el7ost |
| Ubuntu 14.04 LTS | python-django | 1.6.1-2ubuntu0.10 |