Description
contrib.sessions.middleware.SessionMiddleware in Django 1.8.x before 1.8.4, 1.7.x before 1.7.10, 1.4.x before 1.4.22, and possibly other versions allows remote attackers to cause a denial of service (session store consumption or session record removal) via a large number of requests to contrib.auth.views.logout, which triggers the creation of an empty session record.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | python-django | 1.7.10-1 | — |
| Debian 13 | python-django | 1.7.10-1 | — |
| Debian 12 | python-django | 1.7.10-1 | — |
| Debian 8 | python-django | 1.7.7-1+deb8u2 | DSA-3338-1 |
| Debian 7 | python-django | 1.4.5-1+deb7u13 | DSA-3338-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 6.0 | python-django | 1.2.3-3+squeeze14 | DLA-301-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 14.04 LTS | python-django | 1.6.1-2ubuntu0.10 | USN-2720-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenStack 7 | python-django +2 | 1.8.4-1.el7 | RHSA-2015:1876 |
| Red Hat OpenStack 6 | python-django +2 | 1.6.11-3.el7ost | RHSA-2015:1894 |
| Red Hat OpenStack 5 | python-django +2 | 1.6.11-3.el6ost | RHSA-2015:1767, RHSA-2015:1766 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Package Hub 12 SP1 | python-Django | 1.11.15-2.1 | openSUSE-SU-2023:0077-1 |
| SUSE OpenStack Cloud 5 | python-Django | 1.6.11-10.2 | SUSE-SU-2015:1810-1 |
| SUSE Enterprise Storage 2 | python-Django | 1.6.11-3.1 | SUSE-SU-2016:0044-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Enterprise Storage 1.0 | python-Django | 1.6.11-8.1 | SUSE-SU-2015:1815-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | python-Django | 1.9.12-1.1 | openSUSE-SU-2026:11248-1, openSUSE-SU-2024:13887-1, openSUSE-SU-2024:11205-1 |
| openSUSE Tumbleweed | python-Django4 | 4.2.14-1.1 | openSUSE-SU-2026:11235-1, openSUSE-SU-2024:14208-1 |
| openSUSE Tumbleweed | python-Django5 | 5.2.16-1.1 | openSUSE-SU-2026:11270-1 |
| openSUSE Tumbleweed | python-Django6 | 6.0-1.1 | openSUSE-SU-2026:10005-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | django | >= 1.8, < 1.8.4 | 1.8.4 | GHSA-pgxh-wfw4-jx2v |
| PyPI | django | >= 1.7, < 1.7.10 | 1.7.10 | GHSA-pgxh-wfw4-jx2v |
| PyPI | django | >= 1.4, < 1.4.22 | 1.4.22 | GHSA-pgxh-wfw4-jx2v |
| PyPI | django | >= 1.8, < 1.8.4 · >= 1.7, < 1.7.10 · >= 1.4, < 1.4.22 | 1.8.4, 1.7.10, 1.4.22 | PYSEC-2015-22 |
Advisories 19
- openSUSE-SU-2026:11270-1 python313-Django5-5.2.16-1.1 on GA media SUSE / openSUSE Security Updates · Jul 15, 2026
- openSUSE-SU-2026:11248-1 python313-Django-5.2.16-1.1 on GA media SUSE / openSUSE Security Updates · Jul 11, 2026
- openSUSE-SU-2026:11235-1 python313-Django4-4.2.30-4.1 on GA media SUSE / openSUSE Security Updates · Jul 10, 2026
- RHSA-2015:1894 Red Hat Security Advisory: python-django security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2015:1876 Red Hat Security Advisory: python-django security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2015:1766 Red Hat Security Advisory: python-django security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2015:1767 Red Hat Security Advisory: python-django security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- openSUSE-SU-2026:10005-1 python312-Django6-6.0-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- DSA-3338-1 python-django - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-301-1 python-django - security update Debian Security (DSA / DLA) · Mar 9, 2026
- USN-2720-1 python-django vulnerability Ubuntu Security Notices (USN) · Feb 10, 2026
- openSUSE-SU-2024:11205-1 python36-Django-3.2.7-2.3 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:13887-1 python310-Django-4.2.11-2.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2016:0044-1 Security update for python-Django SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2023:0077-1 Security update for python-Django SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2015:1815-1 Security update for python-Django SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:14208-1 python310-Django4-4.2.14-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2015:1810-1 Security update for python-Django SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10066-1 python-Django-1.9.12-1.1 on GA media SUSE / openSUSE Security Updates · May 7, 2025
References
- FEDORA-2015-1dd5bc998f vendor-advisory
- openSUSE-SU-2015:1580 vendor-advisory
- RHSA-2015:1894 vendor-advisory
- DSA-3338 vendor-advisory
- 1033318 vdb-entry
- RHSA-2015:1767 vendor-advisory
- openSUSE-SU-2015:1598 vendor-advisory
- USN-2720-1 vendor-advisory
- RHSA-2015:1766 vendor-advisory
- RHSA-2015:1876 vendor-advisory
- 76428 vdb-entry
- https://www.djangoproject.com/weblog/2015/aug/18/security-releases/
- http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html