Skip to content
OpenAdvisories
High USN-2720-1 2 CVEs

python-django vulnerability

Published Aug 18, 2015 · Updated Feb 10, 2026

Ecosystem: Ubuntu

Summary

Lin Hua Cheng discovered that Django incorrectly handled the session store.
A remote attacker could use this issue to cause the session store to fill
up, resulting in a denial of service.

Fixed packages 1

ReleasePackageFixed in
Ubuntu · 14.04 LTS 14.04:LTS python-django 1.6.1-2ubuntu0.10

Vulnerabilities 2

  • High 7.5
    CVE-2015-5963

    Django denial of service via empty session record creation

    contrib.sessions.middleware.SessionMiddleware in Django 1.8.x before 1.8.4, 1.7.x before 1.7.10, 1.4.x before 1.4.22, and possibly other versions allows remote attackers to cause a denial of service (session store consumption or session record removal) via a …

    python-django django python-django Debian Ubuntu PyPI
  • High 7.5
    CVE-2015-5964

    Denial-of-service possibility in logout() view by filling session store

    The (1) contrib.sessions.backends.base.SessionBase.flush and (2) cache_db.SessionStore.flush functions in Django 1.7.x before 1.7.10, 1.4.x before 1.4.22, and possibly other versions create empty sessions in certain circumstances, which allows remote attacker…

    python-django django python-django Debian Ubuntu PyPI

References

  • report
    https://ubuntu.com/security/CVE-2015-5963
  • report
    https://ubuntu.com/security/CVE-2015-5964