NetSight
IP …
medium5.0

CVE-2015-5964

The (1) contrib.sessions.backends.base.SessionBase.flush and (2) cache_db.SessionStore.flush functions in Django 1.7.x before 1.7.10, 1.4.x before 1.4.22, and …

Impact

The (1) contrib.sessions.backends.base.SessionBase.flush and (2) cache_db.SessionStore.flush functions in Django 1.7.x before 1.7.10, 1.4.x before 1.4.22, and possibly other versions create empty sessions in certain circumstances, which allows remote attackers to cause a denial of service (session store consumption) via unspecified vectors.

Affected products

VendorProductAffected versions
DjangoprojectDjango
Versions 1.4, 1.4.1, 1.4.2, 1.4.4, 1.4.5, 1.4.6
CanonicalUbuntu Linux
Versions 12.04, 14.04, 15.04
OracleSolaris
Version 11.3

Weakness classification

CWE-399

References