CVE-2019-6975

Advisory

Django 1.11.19, 2.0.11 and 2.1.6 include a fix for CVE-2019-6975: Uncontrolled Memory Consumption via a malicious attacker-supplied value to the django.utils.numberformat.format() function.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

===========================

*February 11, 2019*

Django 2.0.11 fixes a security issue in 2.0.10.


===========================

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-6975
• https://www.openwall.com/lists/oss-security/2019/02/11/1
• https://www.djangoproject.com/weblog/2019/feb/11/security-releases/
• https://groups.google.com/forum/#!topic/django-announce/WTwEAprR0IQ
• https://docs.djangoproject.com/en/dev/releases/security/
• http://www.securityfocus.com/bid/106964
• https://usn.ubuntu.com/3890-1/
• https://lists.fedoraproject.org/archives/list/[email protected]/message/HVXDOVCXLD74SHR2BENGCE2OOYYYWJHZ/
• https://lists.fedoraproject.org/archives/list/[email protected]/message/66WMXHGBXD7GSM3PEXVCMCAGLMQYHZCU/
• https://www.debian.org/security/2019/dsa-4476
• https://seclists.org/bugtraq/2019/Jul/10