{"id":"CVE-2015-5964","published":"2015-08-24T14:00:00Z","modified":"2024-08-06T07:06:34Z","title":"The (1) contrib.sessions.backends.base.SessionBase.flush and (2) cache_db.SessionStore.flush functions in Django 1.7.x…","vendor":null,"product":null,"tier":"tail","description":{"text":"The (1) contrib.sessions.backends.base.SessionBase.flush and (2) cache_db.SessionStore.flush functions in Django 1.7.x before 1.7.10, 1.4.x before 1.4.22, and possibly other versions create empty sessions in certain circumstances, which allows remote attackers to cause a denial of service (session store consumption) via unspecified vectors.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.04969,"percentile":0.92174,"provenance":"source"},"cwes":[],"references":[{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172084.html","tags":["vendor-advisory","x_refsource_FEDORA"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-1894.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://www.debian.org/security/2015/dsa-3338","tags":["vendor-advisory","x_refsource_DEBIAN"]},{"url":"http://www.securitytracker.com/id/1033318","tags":["vdb-entry","x_refsource_SECTRACK"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-1767.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://www.ubuntu.com/usn/USN-2720-1","tags":["vendor-advisory","x_refsource_UBUNTU"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-1766.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://www.securityfocus.com/bid/76440","tags":["vdb-entry","x_refsource_BID"]},{"url":"https://www.djangoproject.com/weblog/2015/aug/18/security-releases/","tags":["x_refsource_MISC"]},{"url":"http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html","tags":["x_refsource_CONFIRM"]}],"priority":{"score":18.4,"factors":[{"name":"EPSS percentile","points":18.43}]},"affected":[{"ecosystem":"PyPI","package":"Django","vulnerableRanges":[">=1.7, <1.7.10",">=1.4, <1.4.22"],"patched":["1.7.10","1.4.22"],"from":["GHSA-x38m-486c-2wr9","PYSEC-2015-23"],"provenance":"source"}],"euvd":{"id":"EUVD-2015-0012","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-django-cve-2015-5143","parents":[{"from":"CVE-2015-5143","to":"CVE-2015-5964","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["django/contrib/sessions/backends/cached_db.py","django/contrib/sessions/tests.py"],"commits":["https://github.com/django/django/commit/1828f4341ec53a8684112d24031b767eba557663","https://github.com/django/django/commit/2e47f3e401c29bc2ba5ab794d483cb0820855fb9","https://github.com/django/django/commit/2f5485346ee6f84b4e52068c04e043092daf55f7","https://github.com/django/django/commit/575f59f9bc7c59a5e41a081d1f5f55fc859c5012"],"basis":"rarely changed file"}]}],"packageHistory":[{"cve":"CVE-2015-0220","published":"2015-01-16","fixed":"1.7.3","kev":false},{"cve":"CVE-2015-0221","published":"2015-01-16","fixed":"1.7.3","kev":false},{"cve":"CVE-2015-0222","published":"2015-01-16","fixed":"1.7.3","kev":false},{"cve":"CVE-2015-5964","published":"2015-08-24","fixed":"1.7.10","kev":false},{"cve":"CVE-2015-2241","published":"2015-03-12","fixed":"1.8b2","kev":false},{"cve":"CVE-2015-2316","published":"2015-03-25","fixed":"1.8c1","kev":false},{"cve":"CVE-2015-2317","published":"2015-03-25","fixed":"1.8c1","kev":false},{"cve":"CVE-2015-5144","published":"2015-07-14","fixed":"1.8.3","kev":false,"link":{"from":"CVE-2015-5144","to":"CVE-2015-5964","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:Django","fromFixed":"1.7.9","toFixed":"1.7.10","daysApart":41}]}}],"package":"PyPI:Django"}}