CVE-2015-5143: High severity django vulnerability

Q: What is the severity of CVE-2015-5143?

CVE-2015-5143 is classified as a high severity vulnerability due to its potential for causing a denial of service.

Q: How do I fix CVE-2015-5143?

To fix CVE-2015-5143, upgrade Django to version 1.4.21, 1.7.9, or 1.8.3 or later.

Q: Which versions of Django are affected by CVE-2015-5143?

The affected versions of Django include all versions prior to 1.4.21, 1.5.x through 1.6.x, 1.7.x prior to 1.7.9, and 1.8.x prior to 1.8.3.

Q: What type of attack does CVE-2015-5143 allow?

CVE-2015-5143 allows remote attackers to exploit the vulnerability by making multiple requests with unique session keys to exhaust the session store.

Q: Is there any workaround for CVE-2015-5143 if I cannot upgrade?

There is no specific workaround for CVE-2015-5143; upgrading to the secure versions is recommended.

Published Jul 14, 2015

Updated

The session backends in Django before 1.4.21, 1.5.x through 1.6.x, 1.7.x before 1.7.9, and 1.8.x before 1.8.3 allows remote attackers to cause a denial of service (session store consumption) via multiple requests with unique session keys.

Affected Software

60 affected componentsFixes available

pip/Django>=1.8<1.8.3

1.8.3

pip/Django>=1.5<1.7.9

1.7.9

pip/django<1.4.21

1.4.21

djangoproject Django=1.4.20

djangoproject Django=1.5

djangoproject Django=1.5-alpha

djangoproject Django=1.5-beta

djangoproject Django=1.5.1

djangoproject Django=1.5.2

djangoproject Django=1.5.3

djangoproject Django=1.5.4

djangoproject Django=1.5.5

djangoproject Django=1.5.6

djangoproject Django=1.5.7

djangoproject Django=1.5.8

djangoproject Django=1.5.9

djangoproject Django=1.5.10

djangoproject Django=1.5.11

djangoproject Django=1.5.12

djangoproject Django=1.6

djangoproject Django=1.6-beta1

djangoproject Django=1.6-beta2

djangoproject Django=1.6-beta3

djangoproject Django=1.6-beta4

djangoproject Django=1.6.1

djangoproject Django=1.6.2

djangoproject Django=1.6.3

djangoproject Django=1.6.4

djangoproject Django=1.6.5

djangoproject Django=1.6.6

djangoproject Django=1.6.7

djangoproject Django=1.6.8

djangoproject Django=1.6.9

djangoproject Django=1.6.10

djangoproject Django=1.7-beta1

djangoproject Django=1.7-beta2

djangoproject Django=1.7-beta3

djangoproject Django=1.7-beta4

djangoproject Django=1.7-rc1

djangoproject Django=1.7-rc2

djangoproject Django=1.7-rc3

djangoproject Django=1.7.1

djangoproject Django=1.7.2

djangoproject Django=1.7.3

djangoproject Django=1.7.4

djangoproject Django=1.7.5

djangoproject Django=1.7.6

djangoproject Django=1.7.7

djangoproject Django=1.7.8

djangoproject Django=1.7.9

djangoproject Django=1.8.0

djangoproject Django=1.8.1

djangoproject Django=1.8.2

Debian Debian Linux=7.0

Debian Debian Linux=8.0

Oracle Solaris=11.3

Canonical Ubuntu Linux=12.04

Canonical Ubuntu Linux=14.04

Canonical Ubuntu Linux=15.04

Canonical Ubuntu Linux=15.10

Remediation

Patch Available

https://www.djangoproject.com/weblog/2015/jul/08/security-releases/

Event History

Jul 14, 2015

CVE Published

via MITRE·05:00 PM

Data Sourced

via MITRE·05:00 PM

Description

Jul 5, 2019

Advisory Published

via GitHub·09:10 PM

Frequently Asked Questions

What is the severity of CVE-2015-5143?

CVE-2015-5143 is classified as a high severity vulnerability due to its potential for causing a denial of service.

How do I fix CVE-2015-5143?