PT-2015-1975 · Django Software Foundation+2 · Django+2

Lin Hua Cheng · Publicado 2015-08-18 · Atualizado 2022-05-17 · CVE-2015-5964

Positive Technologies (AI Summary)

CVSS v4.0

6.6

Média

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U

Name of the Vulnerable Software and Affected Versions Django versions 1.4.x through 1.4.21 Django versions 1.7.x through 1.7.9

Description The issue is related to errors in resource management in the contrib.sessions.backends.base.SessionBase.flush and cache db.SessionStore.flush functions of the Django framework. This can be exploited by a remote attacker to cause a denial of service under certain conditions. The exploitation allows attackers to consume session store resources, leading to a denial of service.

Recommendations For Django versions 1.4.x through 1.4.21, update to version 1.4.22 or later. For Django versions 1.7.x through 1.7.9, update to version 1.7.10 or later.

Correção

DoS

Enumeração de Fraquezas

CWE-399

Identificadores relacionados

ALT-PU-2015-1872

BDU:2015-11321

CVE-2015-5964

DLA-301-1

DSA-3338-1

GHSA-X38M-486C-2WR9

MGASA-2015-0327

PYSEC-2015-23

RHSA-2015:1766

RHSA-2015:1767

RHSA-2015:1894

USN-2720-1

Produtos afetados

Alt Linux

Django

Ubuntu

Referências · 36

• https://github.com/django/django · Nota
• https://github.com/django/django/commit/575f59f9bc7c59a5e41a081d1f5f55fc859c5012 · Nota
• https://github.com/django/django/commit/2f5485346ee6f84b4e52068c04e043092daf55f7 · Nota
• https://github.com/django/django/commit/8cc41ce7a7a8f6bebfdd89d5ab276cd0109f4fc5 · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2015-23.yaml · Nota
• http://rhn.redhat.com/errata/RHSA-2015-1767.html · Aviso do Fabricante
• https://osv.dev/vulnerability/USN-2720-1 · Aviso do Fabricante
• http://rhn.redhat.com/errata/RHSA-2015-1766.html · Aviso do Fabricante
• https://web.archive.org/web/20150923161048/http://securitytracker.com/id/1033318 · Nota
• http://rhn.redhat.com/errata/RHSA-2015-1894.html · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2015-5964 · Aviso do Fabricante
• http://ubuntu.com/usn/USN-2720-1 · Aviso do Fabricante
• http://securityfocus.com/bid/76440 · Nota
• http://oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html · Nota
• https://osv.dev/vulnerability/GHSA-x38m-486c-2wr9 · Aviso do Fabricante