GHSA-6wgp-fwfm-mxp3

Django allows user sessions hijacking via an empty string in the session key

Source: GitHub Advisory Database (reviewed) Moderate CVE-2015-3982

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	Django	>= 1.8a1, < 1.8.2	1.8.2

Details

As written in the advisory (Markdown source, shown as plain text).

The session.flush function in the cached_db backend in Django 1.8.x before 1.8.2 does not properly flush the session, which allows remote attackers to hijack user sessions via an empty string in the session key.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2015-3982 advisory
https://github.com/django/django/commit/31cb25adecba930bdeee4556709f5a1c42d88fd6 web
https://github.com/django/django package
https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2015-19.yaml web
https://web.archive.org/web/20200228092138/http://www.securityfocus.com/bid/74960 web
https://www.djangoproject.com/weblog/2015/may/20/security-release web