Denial Of Service (DoS) Session Store Consumption Or Session Record Removal

2019-01-1509:07:44

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

JSON

Django is vulnerable to denial of service through session store consumption or session record removal. This is caused in contrib.sessions.middleware.SessionMiddleware when a large number of requests are made to contrib.auth.views.logout, triggering the creation of empty session records, using up the store.

CPENameOperatorVersion
python-djangoeq1.6.5__1.el7
python-djangoeq1.6.5__2.el6ost
python-djangoeq1.6.11__1.el6ost
python-djangoeq1.6.11__2.el7ost
python-djangoeq1.8.3__1.el7
python-djangoeq1.6.11__3.el7ost

Name	Operator	Version
python-django	eq	1.6.5__1.el7
python-django	eq	1.6.5__2.el6ost
python-django	eq	1.6.11__1.el6ost
python-django	eq	1.6.11__2.el7ost
python-django	eq	1.8.3__1.el7
python-django	eq	1.6.11__3.el7ost