{"id":"DEBIAN-CVE-2011-4136","details":"django.contrib.sessions in Django before 1.2.7 and 1.3.x before 1.3.1, when session data is stored in the cache, uses the root namespace for both session identifiers and application-data keys, which allows remote attackers to modify a session by triggering use of a key that is equal to that session's identifier.","modified":"2025-11-19T02:04:39.276815Z","published":"2011-10-19T10:55:03.927Z","upstream":["CVE-2011-4136"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2011-4136"}],"affected":[{"package":{"name":"python-django","ecosystem":"Debian:11","purl":"pkg:deb/debian/python-django?arch=source"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.1-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2011-4136.json"}},{"package":{"name":"python-django","ecosystem":"Debian:12","purl":"pkg:deb/debian/python-django?arch=source"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.1-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2011-4136.json"}},{"package":{"name":"python-django","ecosystem":"Debian:13","purl":"pkg:deb/debian/python-django?arch=source"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.1-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2011-4136.json"}},{"package":{"name":"python-django","ecosystem":"Debian:14","purl":"pkg:deb/debian/python-django?arch=source"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.1-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2011-4136.json"}}],"schema_version":"1.7.3"}