Bug 1221526 (CVE-2015-3982) - CVE-2015-3982 django: incorrect session flushing in the cached_db backend
Summary: CVE-2015-3982 django: incorrect session flushing in the cached_db backend
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2015-3982
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2015-05-14 09:38 UTC by Martin Prpič
Modified: 2021-02-17 05:18 UTC (History)
1 user (show)

Fixed In Version: Django 1.8.2
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2015-05-14 09:40:50 UTC


Attachments (Terms of Use)
cached-db-master.patch (2.26 KB, text/plain)
2015-05-14 09:39 UTC, Martin Prpič
no flags Details
cached-db-1.8.patch (2.33 KB, text/plain)
2015-05-14 09:39 UTC, Martin Prpič
no flags Details

Description Martin Prpič 2015-05-14 09:38:27 UTC
The following flaw was found in Django 1.8:

A change to session.flush() in the cached_db session backend in Django 1.8 mistakenly sets the session key to an empty string rather than None. An empty string is treated as a valid session key and the session cookie is set accordingly. Any users with an empty string in their session cookie will use the same session store. session.flush() is called by django.contrib.auth.logout() and, more seriously, by django.contrib.auth.login() when a user switches accounts. If a user is logged in and logs in again to a different account (without logging out) the session is flushed to avoid reuse. After the session is flushed (and its session key becomes '') the account details are set on the session and the session is saved. Any users with an empty string in their session cookie will now be logged into that account.

Acknowledgements:

Red Hat would like to thank the upstream Django project for reporting this issue.

Comment 1 Martin Prpič 2015-05-14 09:39:21 UTC
Created attachment 1025330 [details]
cached-db-master.patch

Comment 2 Martin Prpič 2015-05-14 09:39:43 UTC
Created attachment 1025331 [details]
cached-db-1.8.patch

Comment 3 Martin Prpič 2015-05-14 09:40:50 UTC
Statement:

Not vulnerable. The 1.8 version of Django is not shipped in any Red Hat product.

Comment 4 Martin Prpič 2015-05-22 10:37:30 UTC
External References:

https://www.djangoproject.com/weblog/2015/may/20/security-release/


Note You need to log in before you can comment on or make changes to this bug.