Skip to content
OpenAdvisories
High DSA-3338-1 2 CVEs

python-django - security update

Published Aug 18, 2015 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 2

ReleasePackageFixed in
Debian · 7 python-django 1.4.5-1+deb7u13
Debian · 8 python-django 1.7.7-1+deb8u2

Vulnerabilities 2

  • High 7.5
    CVE-2015-5963

    Django denial of service via empty session record creation

    contrib.sessions.middleware.SessionMiddleware in Django 1.8.x before 1.8.4, 1.7.x before 1.7.10, 1.4.x before 1.4.22, and possibly other versions allows remote attackers to cause a denial of service (session store consumption or session record removal) via a …

    python-django django python-django Debian Ubuntu PyPI
  • High 7.5
    CVE-2015-5964

    Denial-of-service possibility in logout() view by filling session store

    The (1) contrib.sessions.backends.base.SessionBase.flush and (2) cache_db.SessionStore.flush functions in Django 1.7.x before 1.7.10, 1.4.x before 1.4.22, and possibly other versions create empty sessions in certain circumstances, which allows remote attacker…

    python-django django python-django Debian Ubuntu PyPI