CVE-2015-5963

Publication date 18 August 2015

Last updated 24 July 2024

Ubuntu priority

contrib.sessions.middleware.SessionMiddleware in Django 1.8.x before 1.8.4, 1.7.x before 1.7.10, 1.4.x before 1.4.22, and possibly other versions allows remote attackers to cause a denial of service (session store consumption or session record removal) via a large number of requests to contrib.auth.views.logout, which triggers the creation of an empty session record.

Status

Show unmaintained releases

Package	Ubuntu Release	Status
python-django	15.04 vivid	Fixed 1.7.6-1ubuntu2.2
	14.04 LTS trusty	Fixed 1.6.1-2ubuntu0.10
	12.04 LTS precise	Fixed 1.3.1-4ubuntu1.18

How can I get the fixes?
What do statuses mean?

References

MITRE
NVD
Launchpad
Debian

Related Ubuntu Security Notices (USN)

USN-2720-1
Django vulnerability
18 August 2015

Other references

https://www.djangoproject.com/weblog/2015/aug/18/security-releases/
https://www.cve.org/CVERecord?id=CVE-2015-5963