Denial Of Service (DoS) Session Store Consumption Or Session Record Removal

2019-01-1509:07:44

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.024 Low

EPSS

Percentile

89.9%

JSON

Django is vulnerable to denial of service through session store consumption or session record removal. This is caused in contrib.sessions.middleware.SessionMiddleware when a large number of requests are made to contrib.auth.views.logout, triggering the creation of empty session records, using up the store.

CPENameOperatorVersion
python-djangoeq1.6.5__1.el7
python-djangoeq1.6.5__2.el6ost
python-djangoeq1.6.11__1.el6ost
python-djangoeq1.6.11__2.el7ost
python-djangoeq1.8.3__1.el7
python-djangoeq1.6.11__3.el7ost

Name	Operator	Version
python-django	eq	1.6.5__1.el7
python-django	eq	1.6.5__2.el6ost
python-django	eq	1.6.11__1.el6ost
python-django	eq	1.6.11__2.el7ost
python-django	eq	1.8.3__1.el7
python-django	eq	1.6.11__3.el7ost