CVE-2015-5963

contrib.sessions.middleware.SessionMiddleware in Django 1.8.x before 1.8.4, 1.7.x before 1.7.10, 1.4.x before 1.4.22, and possibly other versions allows remote attackers to cause a denial of service (session store consumption or session record removal) via a large number of requests to contrib.auth.views.logout, which triggers the creation of an empty session record.

Lin Hua Cheng discovered that Django incorrectly handled the session store. A remote attacker could use this issue to cause the session store to fill up, resulting in a denial of service.

This update for python-Django fixes the following issues:

• CVE-2023-24580: Prevent DOS in file uploads. (boo#1208082)

update to 1.11.15

• CVE-2018-14574: Fixed Open redirect possibility in CommonMiddleware (boo#1102680)
• Fixed WKBWriter.write() and write_hex() for empty polygons on GEOS 3.6.1+
• Fixed a regression in Django 1.10 that could result in large memory usage when making edits using ModelAdmin.list_editable
• Fixed a regression in Django 1.11.12 where QuerySet.values() or values_list() after combining an annotated and unannotated queryset with union(), difference(), or intersection() crashed due to mismatching columns
• Fixed crashes in django.contrib.admindocs when a view is a callable object, such as django.contrib.syndication.views.Feed
• Fixed a regression in Django 1.11.8 where altering a field with a unique constraint may drop and rebuild more foreign keys than necessary
• Fixed a regression in Django 1.11.8 where combining two annotated values_list() querysets with union(), difference(), or intersection() crashed due to mismatching columns
• Fixed a regression in Django 1.11 where an empty choice could be initially selected for the SelectMultiple and CheckboxSelectMultiple widgets

• Update to 1.11.11

  • Fixes CVE-2018-7536, CVE-2018-7537

• Update to 1.11.10 LTS

  • Fixes CVE-2018-6188 boo#1077714, CVE-2017-7234, CVE-2017-7233, CVE-2017-12794

• Change Requires: python-Pillow to python-imaging for compatibility with SLE-12 which provides PIL instead of Pillow.

• Update to 1.9.9

  Bugfixes

  • Fixed invalid HTML in template postmortem on the debug page (#26938).
  • Fixed some GIS database function crashes on MySQL 5.7 (#26657).

• Update to 1.9.8 Fix XSS in admin’s add/change related popup (boo#988420) Unsafe usage of JavaScript’s Element.innerHTML could result in XSS in the admin’s add/change related popup. Element.textContent is now used to prevent execution of the data. The debug view also used innerHTML. Although a security issue wasn’t identified there, out of an abundance of caution it’s also updated to use textContent. Bugfixes

  • Fixed missing varchar/text_pattern_ops index on CharField and TextField respectively when using AddField on PostgreSQL (#26889).
  • Fixed makemessages crash on Python 2 with non-ASCII file names (#26897).

• Update to 1.9.7 Bugfixes

  • Removed the need for the request context processor on the admin login page to fix a regression in 1.9 (#26558).
  • Fixed translation of password validators’ help_text in forms (#26544).
  • Fixed a regression causing the cached template loader to crash when using lazy template names (#26603).
  • Fixed on_commit callbacks execution order when callbacks make transactions (#26627).
  • Fixed HStoreField to raise a ValidationError instead of crashing on non-dictionary JSON input (#26672).
  • Fixed dbshell crash on PostgreSQL with an empty database name (#26698).
  • Fixed a regression in queries on a OneToOneField that has to_field and primary_key=True (#26667).

• Update to 1.9.6 Bugfixes

  • Added support for relative path redirects to the test client and to SimpleTestCase.assertRedirects() because Django 1.9 no longer converts redirects to absolute URIs (#26428).
  • Fixed TimeField microseconds round-tripping on MySQL and SQLite (#26498).
  • Prevented makemigrations from generating infinite migrations for a model field that references a functools.partial (#26475).
  • Fixed a regression where SessionBase.pop() returned None rather than raising a KeyError for nonexistent values (#26520).
  • Fixed a regression causing the cached template loader to crash when using template names starting with a dash (#26536).
  • Restored conversion of an empty string to null when saving values of GenericIPAddressField on SQLite and MySQL (#26557).
  • Fixed a makemessages…

These are all security issues fixed in the python-Django-1.9.12-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python36-Django-3.2.7-2.3 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python310-Django-4.2.11-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python310-Django4-4.2.14-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python312-Django6-6.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python313-Django4-4.2.30-4.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python313-Django-5.2.16-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python313-Django5-5.2.16-1.1 package on the GA media of openSUSE Tumbleweed.

contrib.sessions.middleware.SessionMiddleware in Django 1.8.x before 1.8.4, 1.7.x before 1.7.10, 1.4.x before 1.4.22, and possibly other versions allows remote attackers to cause a denial of service (session store consumption or session record removal) via a large number of requests to contrib.auth.views.logout, which triggers the creation of an empty session record.

This update for python-Django fixes the following security issues:

• Prevent Denial-of-service possibility by filling session store. (bsc#937522, CVE-2015-5143)
• Prevent Header injection possibility. (bsc#937523, CVE-2015-5144)
• A remote denial of service (resource exhaustion) attack against the django session store was fixed in Python Django. This might have allowed remote attackers to exhaust existing web sessions. (bsc#941587, CVE-2015-5963)

This update for python-Django fixes the following security issues:

• Prevent Denial-of-service possibility by filling session store. (bsc#937522, CVE-2015-5143)
• Prevent Header injection possibility. (bsc#937523, CVE-2015-5144)
• A remote denial of service (resource exhaustion) attack against the django session store was fixed in Python Django. This might have allowed remote attackers to exhaust existing web sessions. (bsc#941587, CVE-2015-5963)

This update fixes the following security issues:

• (bnc#955412, CVE-2015-8213) Possible settings leak in date template filter

• (bnc#937522, CVE-2015-5143) Possible denial-of-service in session store

• (bnc#937523, CVE-2015-5144) Possible Header injection

• (bnc#941587, CVE-2015-5963) Possible denial-of-service by filling session store via logout()

contrib.sessions.middleware.SessionMiddleware in Django 1.8.x before 1.8.4, 1.7.x before 1.7.10, 1.4.x before 1.4.22, and possibly other versions allows remote attackers to cause a denial of service (session store consumption or session record removal) via a large number of requests to contrib.auth.views.logout, which triggers the creation of an empty session record.

Lin Hua Cheng discovered that Django incorrectly handled the session store. A remote attacker could use this issue to cause the session store to fill up, resulting in a denial of service.