CVE-2011-4136: Input Validation
django.contrib.sessions in Django before 1.2.7 and 1.3.x before 1.3.1, when session data is stored in the cache, uses the root namespace for both session identifiers and application-data keys, which allows remote attackers to modify a session by triggering use of a key that is equal to that session's identifier.
Other sources
Multiple security flaws have been recently addressed in the v1.3.1 and v1.2.7 versions of the Django Python Web framework (from [1]): 1, Session manipulation, 2, Denial of service attack via URLField, 3, URLField redirection, 4, Host header cache poisoning, 5, Host header and CSRF, 6, Cross-subdomain CSRF attacks, 7, DEBUG pages and sensitive POST data
References: [1] https://www.djangoproject.com/weblog/2011/sep/09/
— Red Hat
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2011-4136?
CVE-2011-4136 is rated as low severity due to the limited scope of the vulnerability.
How do I fix CVE-2011-4136?
To fix CVE-2011-4136, upgrade Django to version 1.2.7 or 1.3.1 or later.
What versions of Django are affected by CVE-2011-4136?
CVE-2011-4136 affects Django versions prior to 1.2.7 and 1.3.x prior to 1.3.1.
Can CVE-2011-4136 allow session hijacking?
Yes, CVE-2011-4136 can potentially allow attackers to hijack sessions due to improper session key handling.
Is CVE-2011-4136 related to cache implementation in Django?
Yes, CVE-2011-4136 involves issues with session data stored in the cache using root namespace for session identifiers.