GitHub Advisoryadvisory · PyPI

GHSA-pgxh-wfw4-jx2v Django denial of service via empty session record creation

MEDIUM Published 2022-05-17 Modified 2024-09-17 Official page ↗
Aliases
CVE-2015-5963
Ecosystem
PyPI
Packages
Django
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-770
Reviewed
2023-08-03

Affected packages

• PyPI Django: >= 1.8, < 1.8.4 → fixed in 1.8.4 • PyPI Django: >= 1.7, < 1.7.10 → fixed in 1.7.10 • PyPI Django: >= 1.4, < 1.4.22 → fixed in 1.4.22

Description

`contrib.sessions.middleware.SessionMiddleware` in Django 1.8.x before 1.8.4, 1.7.x before 1.7.10, 1.4.x before 1.4.22, and possibly other versions allows remote attackers to cause a denial of service (session store consumption or session record removal) via a large number of requests to `contrib.auth.views.logout`, which triggers the creation of an empty session record.

Related

Alias · CVE (1)

  • CVE-2015-5963 contrib.sessions.middleware.SessionMiddleware in Django 1.8.x before 1.8.4, 1.7.x before 1.7.10, 1.4.x before 1.4.22, and possibly other… vulnerability

Weakness · CWE (1)

  • CWE-770 Allocation of Resources Without Limits or Throttling weakness

References