PT-2015-2245 · Django Software Foundation+2 · Django+2

Eric Peterson + 1 · Publicado 2015-07-08 · Atualizado 2019-07-05 · CVE-2015-5143

Positive Technologies (AI Summary)

CVSS v4.0

8.7

Alta

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Django versions 1.5.x through 1.6.x Django versions 1.7.x before 1.7.9 Django versions 1.8.x before 1.8.3 Django versions prior to 1.4.21

Description The issue is related to resource management errors in the Django web application platform. It can be exploited by a remote attacker to cause a denial of service by creating multiple requests with unique session keys, leading to session store consumption.

Recommendations For Django versions 1.5.x through 1.6.x, update to a version outside of this range to resolve the issue. For Django versions 1.7.x before 1.7.9, update to version 1.7.9 or later. For Django versions 1.8.x before 1.8.3, update to version 1.8.3 or later. For Django versions prior to 1.4.21, update to version 1.4.21 or later.

Correção

DoS

Allocation of Resources Without Limits

Enumeração de Fraquezas

CWE-399

CWE-770

Identificadores relacionados

ALT-PU-2015-1872

BDU:2015-11591

CVE-2015-5143

DLA-272-1

DSA-3305-1

GHSA-H582-2PCH-3XV3

MGASA-2015-0293

PYSEC-2015-20

RHSA-2015:1678

RHSA-2015:1686

SUSE-SU-2015:1810-1

SUSE-SU-2015:1815-1

SUSE-SU-2016:0044-1

USN-2671-1

Produtos afetados

Alt Linux

Django

Ubuntu

Referências · 50

• https://github.com/django/django · Nota
• https://github.com/django/django/commit/1828f4341ec53a8684112d24031b767eba557663 · Nota
• https://github.com/django/django/commit/2e47f3e401c29bc2ba5ab794d483cb0820855fb9 · Nota
• https://github.com/django/django/commit/66d12d1ababa8f062857ee5eb43276493720bf16 · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2015-20.yaml · Nota
• https://suse.com/security/cve/CVE-2015-5143 · Nota
• http://securitytracker.com/id/1032820 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-5143 · Nota de Segurança
• http://rhn.redhat.com/errata/RHSA-2015-1686.html · Aviso do Fabricante
• https://djangoproject.com/weblog/2015/jul/08/security-releases · Aviso do Fabricante
• http://lists.opensuse.org/opensuse-updates/2015-10/msg00043.html · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2015-5143 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2015-11591 · Nota de Segurança
• https://debian.org/security/2015/dsa-3305 · Aviso do Fabricante
• http://rhn.redhat.com/errata/RHSA-2015-1678.html · Aviso do Fabricante