vulnerability: Django up to 1.4.21/1.7.9/1.8.3 denial of service [CVE-2015-5963] : 8/19/2015 10:58:16 AM

Group Chat & IM for Teams

Communicate with co-workers in real time. Used by Netflix, Dropbox & Salesforce. $0/unlimited users. Get started >>

From our sponsors

Vulnerability Advisories

Vulnerabilities of scip VulDB

Django up to 1.4.21/1.7.9/1.8.3 denial of service [CVE-2015-5963]
8/17/2015 7:00:00 PM

General

scipID: 77329
Affected: Django up to 1.4.21/1.7.9/1.8.3
Published: 08/18/2015 (Lin Hua Cheng)
Risk: problematic

Created: 08/19/2015
Entry: 72.4% complete

Summary

A vulnerability classified as problematic was found in Django up to 1.4.21/1.7.9/1.8.3. Affected by this vulnerability is an unknown function of the component django.contrib.sessions.middleware.SessionMiddleware. The manipulation with an unknown input leads to a denial of service vulnerability. As an impact it is known to affect availability.

The weakness was shared 08/18/2015 by Lin Hua Cheng as Security releases issued: 1.8.4, 1.7.10, 1.4.22 as confirmed news (Website). The advisory is shared for download at djangoproject.com. The vendor cooperated in the coordination of the public release. This vulnerability is known as CVE-2015-5963. The attack can be launched remotely. The exploitation doesn’t need any form of authentication. Neither technical details nor an exploit are publicly available.

Upgrading to version 1.4.22, 1.7.10 or 1.8.4 eliminates this vulnerability. A possible mitigation has been published immediately after the disclosure of the vulnerability. The vulnerability is also documented in the vulnerability database at SecurityTracker (ID 1033318). Entries connected to this vulnerability are available at 77330.

CVSS

Base Score: 4.3 (CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P) [?]
Temp Score: 3.7 (CVSS2#E:ND/RL:OF/RC:C) [?]

CPE

Exploiting

Class: Denial of service
Local: No
Remote: Yes

Availability: No

Countermeasures

Recommended: Upgrade
Status: Official fix
Reaction Time: 0 days since reported
0-Day Time: 0 days since found
Exposure Time: 0 days since known

Upgrade: Django 1.4.22/1.7.10/1.8.4

Timeline

Sources

Advisory: Security releases issued: 1.8.4, 1.7.10, 1.4.22
Researcher: Lin Hua Cheng
Status: Confirmed
Coordinated: Yes

CVE: CVE-2015-5963 (mitre.org) (nvd.nist.org) (cvedetails.com)

SecurityTracker: 1033318 – Django logout() Function Session Management Flaw Lets Remote Users Consume Excessive Session Resources and Deny Service