contrib.sessions.middleware.SessionMiddleware in Django 1.8.x before 1.8.4, 1.7.x before 1.7.10, 1.4.x before 1.4.22, and possibly other versions allows remote attackers to cause a denial of service (session store consumption or session record removal) via a large number of requests to contrib.auth.views.logout, which triggers the creation of an empty session record.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2015:1894 advisory.

    Django is a high-level Python Web framework that encourages rapid     development and a clean, pragmatic design. It focuses on automating as much     as possible and adhering to the DRY (Don't Repeat Yourself) principle.

    It was found that Django incorrectly handled the session store. A session     could be created by anonymously accessing the     django.contrib.auth.views.logout view if it was not decorated correctly     with django.contrib.auth.decorators.login_required. A remote attacker could     use this flaw to fill up the session store or cause other users' session     records to be evicted by requesting a large number of new sessions.
    (CVE-2015-5963)

    It was found that certain Django functions would, in certain circumstances,     create empty sessions. A remote attacker could use this flaw to fill up the     session store or cause other users' session records to be evicted by     requesting a large number of new sessions. (CVE-2015-5964)

    Red Hat would like to thank the upstream Django project for reporting these     issues. Upstream acknowledges Lin Hua Cheng as the original reporter of     CVE-2015-5964.

    All python-django users are advised to upgrade to these updated packages,     which contain backported patches to correct these issues.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

rebase to 1.8.6 (rhbz#1276914) ---- rebase to 1.8.5 (rhbz#1276914)
---- python-django-1.8.4-1.fc23 - Do not install bash completion for python executables (Ville Skytta, rhbz#1253076) - CVE-2015-5963 Denial-of-service possibility in logout() view by filling session store (rhbz#1254911) - CVE-2015-5964 Denial-of-service possibility in logout() view by filling session store (rhbz#1252891)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

python Django was updated to fix a remote denial of service (resource exhaustion) possibility in the auth views module. (bsc#941587, CVE-2015-5963)

Also is_safe_url() was made to reject URLs that start with control characters to mitigate possible XSS attack via user-supplied redirect URLs (bnc#923176, CVE-2015-2317)

  - Method check_for_test_cookie is deprecated, bnc#914706

  - Update to version 1.5.12 with various security fixes :

  + Fixed a regression with dynamically generated inlines     and allowed field references in the admin

  + Allowed related many-to-many fields to be referenced in     the admin

  + Allowed inline and hidden references to admin fields

python Django was updated to fix a remote denial of service (resource exhaustion) possibility in the auth views module. (bsc#941587, CVE-2015-5963)

denial of service possibility in logout() view by filling session store

Previously, a session could be created when anonymously accessing the django.contrib.auth.views.logout view (provided it wasn't decorated with django.contrib.auth.decorators.login_required as done in the admin). This could allow an attacker to easily create many new session records by sending repeated requests, potentially filling up the session store or causing other users' session records to be evicted.

The django.contrib.sessions.middleware.SessionMiddleware has been modified to no longer create empty session records.

This portion of the fix has been assigned CVE-2015-5963.

Additionally, the contrib.sessions.backends.base.SessionBase.flush() and cache_db.SessionStore.flush() methods have been modified to avoid creating a new empty session. Maintainers of third-party session backends should check if the same vulnerability is present in their backend and correct it if so.

This portion of the fix has been assigned CVE-2015-5964.

We recommend that you upgrade your python-django packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Lin Hua Cheng discovered that a session could be created when anonymously accessing the django.contrib.auth.views.logout view. This could allow remote attackers to saturate the session store or cause other users' session records to be evicted.

Additionally the contrib.sessions.backends.base.SessionBase.flush() and cache_db.SessionStore.flush() methods have been modified to avoid creating a new empty session as well.

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-2720-1 advisory.

    Lin Hua Cheng discovered that Django incorrectly handled the session store. A remote attacker could use     this issue to cause the session store to fill up, resulting in a denial of service.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Tim Graham reports :

Denial-of-service possibility in logout() view by filling session store

Previously, a session could be created when anonymously accessing the django.contrib.auth.views.logout view (provided it wasn't decorated with django.contrib.auth.decorators.login_required as done in the admin). This could allow an attacker to easily create many new session records by sending repeated requests, potentially filling up the session store or causing other users' session records to be evicted.

The django.contrib.sessions.middleware.SessionMiddleware has been modified to no longer create empty session records.

This portion of the fix has been assigned CVE-2015-5963.

Additionally, on the 1.4 and 1.7 series only, the contrib.sessions.backends.base.SessionBase.flush() and cache_db.SessionStore.flush() methods have been modified to avoid creating a new empty session. Maintainers of third-party session backends should check if the same vulnerability is present in their backend and correct it if so.

This portion of the fix has been assigned CVE-2015-5964. Anyone reporting a similar vulnerability in a third-party session backend should not use this CVE ID.

Thanks Lin Hua Cheng for reporting the issue.

ID	Name	Product	Family	Severity
193681	RHEL 7 : python-django (RHSA-2015:1894)	Nessus	Red Hat Local Security Checks	medium
89168	Fedora 23 : python-django-1.8.6-1.fc23 (2015-1dd5bc998f)	Nessus	Fedora Local Security Checks	high
86091	openSUSE Security Update : python-django (openSUSE-2015-598)	Nessus	SuSE Local Security Checks	medium
86047	openSUSE Security Update : python-Django (openSUSE-2015-592)	Nessus	SuSE Local Security Checks	medium
85656	Debian DLA-301-1 : python-django security update	Nessus	Debian Local Security Checks	medium
85587	Debian DSA-3338-1 : python-django - security update	Nessus	Debian Local Security Checks	medium
85534	Ubuntu 14.04 LTS : Django vulnerability (USN-2720-1)	Nessus	Ubuntu Local Security Checks	medium
85522	FreeBSD : django -- multiple vulnerabilities (b0e54dc1-45d2-11e5-adde-14dae9d210b8)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2015-5963

medium

Tenable Plugins

medium

high

medium

medium

medium

medium

medium

medium