{"id":"CVE-2015-5143","published":"2015-07-14T17:00:00Z","modified":"2024-08-06T06:32:32Z","title":"The session backends in Django before 1.4.21, 1.5.x through 1.6.x, 1.7.x before 1.7.9, and 1.8.x before 1.8.3 allows…","vendor":null,"product":null,"tier":"tail","description":{"text":"The session backends in Django before 1.4.21, 1.5.x through 1.6.x, 1.7.x before 1.7.9, and 1.8.x before 1.8.3 allows remote attackers to cause a denial of service (session store consumption) via multiple requests with unique session keys.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.07215,"percentile":0.94317,"provenance":"source"},"cwes":[],"references":[{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172084.html","tags":["vendor-advisory","x_refsource_FEDORA"]},{"url":"https://security.gentoo.org/glsa/201510-06","tags":["vendor-advisory","x_refsource_GENTOO"]},{"url":"https://www.djangoproject.com/weblog/2015/jul/08/security-releases/","tags":["x_refsource_CONFIRM"]},{"url":"http://lists.opensuse.org/opensuse-updates/2015-10/msg00043.html","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"http://lists.opensuse.org/opensuse-updates/2015-10/msg00046.html","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"http://www.debian.org/security/2015/dsa-3305","tags":["vendor-advisory","x_refsource_DEBIAN"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-1678.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://www.securityfocus.com/bid/75666","tags":["vdb-entry","x_refsource_BID"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-1686.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://www.ubuntu.com/usn/USN-2671-1","tags":["vendor-advisory","x_refsource_UBUNTU"]},{"url":"http://www.securitytracker.com/id/1032820","tags":["vdb-entry","x_refsource_SECTRACK"]},{"url":"http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html","tags":["x_refsource_CONFIRM"]}],"priority":{"score":18.9,"factors":[{"name":"EPSS percentile","points":18.86}]},"affected":[{"ecosystem":"PyPI","package":"Django","vulnerableRanges":["<1.4.21",">=1.5, <1.7.9",">=1.8, <1.8.3"],"patched":["1.4.21","1.7.9","1.8.3"],"from":["GHSA-h582-2pch-3xv3","PYSEC-2015-20"],"provenance":"source"}],"euvd":{"id":"EUVD-2015-0009","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2015-2316","published":"2015-03-25","fixed":"1.8c1","kev":false},{"cve":"CVE-2015-2317","published":"2015-03-25","fixed":"1.8c1","kev":false,"link":{"from":"CVE-2015-2317","to":"CVE-2015-5143","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:Django","fromFixed":"1.4.20","toFixed":"1.4.21","daysApart":111}]}},{"cve":"CVE-2015-3982","published":"2015-06-02","fixed":"1.8.2","kev":false},{"cve":"CVE-2015-5143","published":"2015-07-14","fixed":"1.8.3","kev":false},{"cve":"CVE-2015-5144","published":"2015-07-14","fixed":"1.8.3","kev":false},{"cve":"CVE-2015-5145","published":"2015-07-14","fixed":"1.8.3","kev":false},{"cve":"CVE-2015-5963","published":"2015-08-24","fixed":"1.8.4","kev":false}],"package":"PyPI:Django"}}