Denial-of-service possibility in logout() view by filling session store Previously, a session could be created when anonymously accessing the django.contrib.auth.views.logout view (provided it wasn't decorated with django.contrib.auth.decorators.login_required as done in the admin). This could allow an attacker to easily create many new session records by sending repeated requests, potentially filling up the session store or causing other users' session records to be evicted. The django.contrib.sessions.middleware.SessionMiddleware has been modified to no longer create empty session records. This portion of the fix has been assigned CVE-2015-5963. Additionally, on the 1.4 and 1.7 series only, the contrib.sessions.backends.base.SessionBase.flush() and cache_db.SessionStore.flush() methods have been modified to avoid creating a new empty session. Maintainers of third-party session backends should check if the same vulnerability is present in their backend and correct it if so. This portion of the fix has been assigned CVE-2015-5964. Anyone reporting a similar vulnerability in a third-party session backend should not use this CVE ID.
commit 449ca833b71668efa0c96f33497d7ca99e627b61 Author: Justin Lecher <jlec@gentoo.org> Date: Tue Aug 18 21:44:40 2015 +0200 dev-python/django: Version Bump for CVE-2015-{5963,5964} Gentoo-Bug: https://bugs.gentoo.org/show_bug.cgi?id=558096 Package-Manager: portage-2.2.20.1 Signed-off-by: Justin Lecher <jlec@gentoo.org> https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=449ca833b71668efa0c96f33497d7ca99e627b61
@arches please stabilize dev-python/django-1.4.22 dev-python/django-1.7.10
amd64 stable
x86 stable. Maintainer(s), please cleanup. Security, please vote.
commit 783a4be550dab8510f3c99a0d3a9605214bf215a Author: Justin Lecher <jlec@gentoo.org> Date: Thu Aug 20 11:19:16 2015 +0200 dev-python/django: Drop vulnerable versions for CVE-2015-{5963,5964} * drop KEYWORDS from masked versions Gentoo-Bug: https://bugs.gentoo.org/show_bug.cgi?id=558096 Package-Manager: portage-2.2.20.1 Signed-off-by: Justin Lecher <jlec@gentoo.org> https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=783a4be550dab8510f3c99a0d3a9605214bf215a
Vote: NO.
CVE-2015-5964 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5964): The (1) contrib.sessions.backends.base.SessionBase.flush and (2) cache_db.SessionStore.flush functions in Django 1.7.x before 1.7.10, 1.4.x before 1.4.22, and possibly other versions create empty sessions in certain circumstances, which allows remote attackers to cause a denial of service (session store consumption) via unspecified vectors. CVE-2015-5963 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5963): contrib.sessions.middleware.SessionMiddleware in Django 1.8.x before 1.8.4, 1.7.x before 1.7.10, 1.4.x before 1.4.22, and possibly other versions allows remote attackers to cause a denial of service (session store consumption or session record removal) via a large number of requests to contrib.auth.views.logout, which triggers the creation of an empty session record.
GLSA Vote: No
