{"id":"CVE-2015-5963","published":"2015-08-24T14:00:00Z","modified":"2024-08-06T07:06:34Z","title":"contrib.sessions.middleware.SessionMiddleware in Django 1.8.x before 1.8.4, 1.7.x before 1.7.10, 1.4.x before 1.4.22…","vendor":null,"product":null,"tier":"tail","description":{"text":"contrib.sessions.middleware.SessionMiddleware in Django 1.8.x before 1.8.4, 1.7.x before 1.7.10, 1.4.x before 1.4.22, and possibly other versions allows remote attackers to cause a denial of service (session store consumption or session record removal) via a large number of requests to contrib.auth.views.logout, which triggers the creation of an empty session record.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.05206,"percentile":0.92468,"provenance":"source"},"cwes":[],"references":[{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172084.html","tags":["vendor-advisory","x_refsource_FEDORA"]},{"url":"http://lists.opensuse.org/opensuse-updates/2015-09/msg00026.html","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-1894.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://www.debian.org/security/2015/dsa-3338","tags":["vendor-advisory","x_refsource_DEBIAN"]},{"url":"http://www.securitytracker.com/id/1033318","tags":["vdb-entry","x_refsource_SECTRACK"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-1767.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://lists.opensuse.org/opensuse-updates/2015-09/msg00035.html","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"http://www.ubuntu.com/usn/USN-2720-1","tags":["vendor-advisory","x_refsource_UBUNTU"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-1766.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2015:1876","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://www.securityfocus.com/bid/76428","tags":["vdb-entry","x_refsource_BID"]},{"url":"https://www.djangoproject.com/weblog/2015/aug/18/security-releases/","tags":["x_refsource_MISC"]},{"url":"http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html","tags":["x_refsource_CONFIRM"]}],"priority":{"score":18.5,"factors":[{"name":"EPSS percentile","points":18.49}]},"affected":[{"ecosystem":"PyPI","package":"Django","vulnerableRanges":[">=1.8, <1.8.4",">=1.7, <1.7.10",">=1.4, <1.4.22"],"patched":["1.8.4","1.7.10","1.4.22"],"from":["GHSA-pgxh-wfw4-jx2v","PYSEC-2015-22"],"provenance":"source"}],"euvd":{"id":"EUVD-2015-0011","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-django-cve-2015-5143","parents":[{"from":"CVE-2015-5143","to":"CVE-2015-5963","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["django/contrib/sessions/backends/cached_db.py","django/contrib/sessions/tests.py"],"commits":["https://github.com/django/django/commit/1828f4341ec53a8684112d24031b767eba557663","https://github.com/django/django/commit/2e47f3e401c29bc2ba5ab794d483cb0820855fb9","https://github.com/django/django/commit/2eb86b01d7b59be06076f6179a454d0fd0afaff6","https://github.com/django/django/commit/2f5485346ee6f84b4e52068c04e043092daf55f7"],"basis":"rarely changed file"}]}],"packageHistory":[{"cve":"CVE-2015-5143","published":"2015-07-14","fixed":"1.8.3","kev":false},{"cve":"CVE-2015-5144","published":"2015-07-14","fixed":"1.8.3","kev":false,"link":{"from":"CVE-2015-5144","to":"CVE-2015-5963","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:Django","fromFixed":"1.7.9","toFixed":"1.7.10","daysApart":41}]}},{"cve":"CVE-2015-5145","published":"2015-07-14","fixed":"1.8.3","kev":false},{"cve":"CVE-2015-5963","published":"2015-08-24","fixed":"1.8.4","kev":false},{"cve":"CVE-2015-8213","published":"2015-12-07","fixed":"1.9rc2","kev":false,"link":{"from":"CVE-2015-5963","to":"CVE-2015-8213","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:Django","fromFixed":"1.7.10","toFixed":"1.7.11","daysApart":105}]}},{"cve":"CVE-2016-2048","published":"2016-02-08","fixed":"1.9.2","kev":false},{"cve":"CVE-2016-2512","published":"2016-04-08","fixed":"1.9.3","kev":false}],"package":"PyPI:Django"}}