—

PYSEC-2015-19

Quick fix

PYSEC-2015-19 — django: upgrade to the fixed version with the command below.

pip install --upgrade 'django>=1.8.2'

Details

The session.flush function in the cached_db backend in Django 1.8.x before 1.8.2 does not properly flush the session, which allows remote attackers to hijack user sessions via an empty string in the session key.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/django

Introduced in: 1.8Fixed in: 1.8.2

Fixpip install --upgrade 'django>=1.8.2'

References

https://www.djangoproject.com/weblog/2015/may/20/security-release/[ARTICLE]
http://www.securityfocus.com/bid/74960[WEB]
https://github.com/advisories/GHSA-6wgp-fwfm-mxp3[ADVISORY]