The (1) contrib.sessions.backends.base.SessionBase.flush and (2) cache_db.SessionStore.flush functions in Django 1.7.x before 1.7.10, 1.4.x before 1.4.22, and possibly other versions create empty sessions in certain circumstances, which allows remote attackers to cause a denial of service (session store consumption) via unspecified vectors.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2015:1894 advisory.

    Django is a high-level Python Web framework that encourages rapid     development and a clean, pragmatic design. It focuses on automating as much     as possible and adhering to the DRY (Don't Repeat Yourself) principle.

    It was found that Django incorrectly handled the session store. A session     could be created by anonymously accessing the     django.contrib.auth.views.logout view if it was not decorated correctly     with django.contrib.auth.decorators.login_required. A remote attacker could     use this flaw to fill up the session store or cause other users' session     records to be evicted by requesting a large number of new sessions.
    (CVE-2015-5963)

    It was found that certain Django functions would, in certain circumstances,     create empty sessions. A remote attacker could use this flaw to fill up the     session store or cause other users' session records to be evicted by     requesting a large number of new sessions. (CVE-2015-5964)

    Red Hat would like to thank the upstream Django project for reporting these     issues. Upstream acknowledges Lin Hua Cheng as the original reporter of     CVE-2015-5964.

    All python-django users are advised to upgrade to these updated packages,     which contain backported patches to correct these issues.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

rebase to 1.8.6 (rhbz#1276914) ---- rebase to 1.8.5 (rhbz#1276914)
---- python-django-1.8.4-1.fc23 - Do not install bash completion for python executables (Ville Skytta, rhbz#1253076) - CVE-2015-5963 Denial-of-service possibility in logout() view by filling session store (rhbz#1254911) - CVE-2015-5964 Denial-of-service possibility in logout() view by filling session store (rhbz#1252891)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

denial of service possibility in logout() view by filling session store

Previously, a session could be created when anonymously accessing the django.contrib.auth.views.logout view (provided it wasn't decorated with django.contrib.auth.decorators.login_required as done in the admin). This could allow an attacker to easily create many new session records by sending repeated requests, potentially filling up the session store or causing other users' session records to be evicted.

The django.contrib.sessions.middleware.SessionMiddleware has been modified to no longer create empty session records.

This portion of the fix has been assigned CVE-2015-5963.

Additionally, the contrib.sessions.backends.base.SessionBase.flush() and cache_db.SessionStore.flush() methods have been modified to avoid creating a new empty session. Maintainers of third-party session backends should check if the same vulnerability is present in their backend and correct it if so.

This portion of the fix has been assigned CVE-2015-5964.

We recommend that you upgrade your python-django packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Lin Hua Cheng discovered that a session could be created when anonymously accessing the django.contrib.auth.views.logout view. This could allow remote attackers to saturate the session store or cause other users' session records to be evicted.

Additionally the contrib.sessions.backends.base.SessionBase.flush() and cache_db.SessionStore.flush() methods have been modified to avoid creating a new empty session as well.

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-2720-1 advisory.

    Lin Hua Cheng discovered that Django incorrectly handled the session store. A remote attacker could use     this issue to cause the session store to fill up, resulting in a denial of service.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Tim Graham reports :

Denial-of-service possibility in logout() view by filling session store

Previously, a session could be created when anonymously accessing the django.contrib.auth.views.logout view (provided it wasn't decorated with django.contrib.auth.decorators.login_required as done in the admin). This could allow an attacker to easily create many new session records by sending repeated requests, potentially filling up the session store or causing other users' session records to be evicted.

The django.contrib.sessions.middleware.SessionMiddleware has been modified to no longer create empty session records.

This portion of the fix has been assigned CVE-2015-5963.

Additionally, on the 1.4 and 1.7 series only, the contrib.sessions.backends.base.SessionBase.flush() and cache_db.SessionStore.flush() methods have been modified to avoid creating a new empty session. Maintainers of third-party session backends should check if the same vulnerability is present in their backend and correct it if so.

This portion of the fix has been assigned CVE-2015-5964. Anyone reporting a similar vulnerability in a third-party session backend should not use this CVE ID.

Thanks Lin Hua Cheng for reporting the issue.

ID	Name	Product	Family	Severity
193681	RHEL 7 : python-django (RHSA-2015:1894)	Nessus	Red Hat Local Security Checks	medium
89168	Fedora 23 : python-django-1.8.6-1.fc23 (2015-1dd5bc998f)	Nessus	Fedora Local Security Checks	high
85656	Debian DLA-301-1 : python-django security update	Nessus	Debian Local Security Checks	medium
85587	Debian DSA-3338-1 : python-django - security update	Nessus	Debian Local Security Checks	medium
85534	Ubuntu 14.04 LTS : Django vulnerability (USN-2720-1)	Nessus	Ubuntu Local Security Checks	medium
85522	FreeBSD : django -- multiple vulnerabilities (b0e54dc1-45d2-11e5-adde-14dae9d210b8)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2015-5964

medium

Tenable Plugins

medium

high

medium

medium

medium

medium