Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 558096 (CVE-2015-5963) - <dev-python/django-{1.4.22,1.7.10,1.8.4}: Denial-of-service (CVE-2015-{5963,5964})
Summary: <dev-python/django-{1.4.22,1.7.10,1.8.4}: Denial-of-service (CVE-2015-{5963,5...
Status: RESOLVED FIXED
Alias: CVE-2015-5963
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal minor (vote)
Assignee: Gentoo Security
URL:
Whiteboard: B3 [noglsa/cve]
Keywords:
Depends on:
Blocks:
 
Reported: 2015-08-18 18:54 UTC by Justin Lecher (RETIRED)
Modified: 2015-11-09 22:17 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Justin Lecher (RETIRED) gentoo-dev 2015-08-18 18:54:04 UTC
Denial-of-service possibility in logout() view by filling session store

Previously, a session could be created when anonymously accessing the django.contrib.auth.views.logout view (provided it wasn't decorated with django.contrib.auth.decorators.login_required as done in the admin). This could allow an attacker to easily create many new session records by sending repeated requests, potentially filling up the session store or causing other users' session records to be evicted.

The django.contrib.sessions.middleware.SessionMiddleware has been modified to no longer create empty session records.

This portion of the fix has been assigned CVE-2015-5963.

Additionally, on the 1.4 and 1.7 series only, the contrib.sessions.backends.base.SessionBase.flush() and cache_db.SessionStore.flush() methods have been modified to avoid creating a new empty session. Maintainers of third-party session backends should check if the same vulnerability is present in their backend and correct it if so.

This portion of the fix has been assigned CVE-2015-5964. Anyone reporting a similar vulnerability in a third-party session backend should not use this CVE ID.
Comment 1 Justin Lecher (RETIRED) gentoo-dev 2015-08-18 19:46:06 UTC
commit 449ca833b71668efa0c96f33497d7ca99e627b61
Author: Justin Lecher <jlec@gentoo.org>
Date:   Tue Aug 18 21:44:40 2015 +0200
    
    dev-python/django: Version Bump for CVE-2015-{5963,5964}
    
    Gentoo-Bug: https://bugs.gentoo.org/show_bug.cgi?id=558096
    
    Package-Manager: portage-2.2.20.1
    Signed-off-by: Justin Lecher <jlec@gentoo.org>
    
    https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=449ca833b71668efa0c96f33497d7ca99e627b61
Comment 2 Justin Lecher (RETIRED) gentoo-dev 2015-08-18 19:46:56 UTC
@arches please stabilize

dev-python/django-1.4.22
dev-python/django-1.7.10
Comment 3 Agostino Sarubbo gentoo-dev 2015-08-20 08:49:06 UTC
amd64 stable
Comment 4 Agostino Sarubbo gentoo-dev 2015-08-20 08:50:00 UTC
x86 stable.

Maintainer(s), please cleanup.
Security, please vote.
Comment 5 Justin Lecher (RETIRED) gentoo-dev 2015-08-20 09:19:36 UTC
commit 783a4be550dab8510f3c99a0d3a9605214bf215a
Author: Justin Lecher <jlec@gentoo.org>
Date:   Thu Aug 20 11:19:16 2015 +0200
    
    dev-python/django: Drop vulnerable versions for CVE-2015-{5963,5964}
    
    * drop KEYWORDS from masked versions
    
    Gentoo-Bug: https://bugs.gentoo.org/show_bug.cgi?id=558096
    
    Package-Manager: portage-2.2.20.1
    Signed-off-by: Justin Lecher <jlec@gentoo.org>
    
    https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=783a4be550dab8510f3c99a0d3a9605214bf215a
Comment 6 Stefan Behte (RETIRED) gentoo-dev Security 2015-11-09 22:07:18 UTC
Vote: NO.
Comment 7 GLSAMaker/CVETool Bot gentoo-dev 2015-11-09 22:17:31 UTC
CVE-2015-5964 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5964):
  The (1) contrib.sessions.backends.base.SessionBase.flush and (2)
  cache_db.SessionStore.flush functions in Django 1.7.x before 1.7.10, 1.4.x
  before 1.4.22, and possibly other versions create empty sessions in certain
  circumstances, which allows remote attackers to cause a denial of service
  (session store consumption) via unspecified vectors.

CVE-2015-5963 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5963):
  contrib.sessions.middleware.SessionMiddleware in Django 1.8.x before 1.8.4,
  1.7.x before 1.7.10, 1.4.x before 1.4.22, and possibly other versions allows
  remote attackers to cause a denial of service (session store consumption or
  session record removal) via a large number of requests to
  contrib.auth.views.logout, which triggers the creation of an empty session
  record.
Comment 8 Kristian Fiskerstrand (RETIRED) gentoo-dev 2015-11-09 22:17:57 UTC
GLSA Vote: No