CVE-2011-4136

Publication date 19 October 2011

Last updated 24 July 2024

Ubuntu priority

django.contrib.sessions in Django before 1.2.7 and 1.3.x before 1.3.1, when session data is stored in the cache, uses the root namespace for both session identifiers and application-data keys, which allows remote attackers to modify a session by triggering use of a key that is equal to that session's identifier.

Status

Show unmaintained releases

Package	Ubuntu Release	Status
python-django	11.10 oneiric	Fixed 1.3-2ubuntu1.1
	11.04 natty	Fixed 1.2.5-1ubuntu1.1
	10.10 maverick	Fixed 1.2.3-1ubuntu0.2.10.10.3
	10.04 LTS lucid	Fixed 1.1.1-2ubuntu1.4
	8.04 LTS hardy	Ignored end of life

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
python-django	Upstream: https://code.djangoproject.com/changeset/16765 Upstream: https://code.djangoproject.com/changeset/16762

References

Related Ubuntu Security Notices (USN)

USN-1297-1
Django vulnerabilities
9 December 2011

Other references

https://www.cve.org/CVERecord?id=CVE-2011-4136