PT-2019-4623 · Django+2 · Django+2
Sjoerd Job Postmus
·
Publicado
2019-02-10
·
Atualizado
2026-01-03
·
CVE-2019-6975
CVSS v4.0
8.7
Alta
| Vetor | AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
Django versions 1.11.x through 1.11.18
Django versions 2.0.x through 2.0.10
Django versions 2.1.x through 2.1.5
Description
The issue is related to uncontrolled memory consumption, which can lead to a complete depletion of resources, potentially causing a denial of service. This can be triggered by a malicious attacker-supplied value to the
django.utils.numberformat.format() function. The vulnerability can be exploited by a remote attacker.Recommendations
For Django versions 1.11.x through 1.11.18, update to version 1.11.19 or later.
For Django versions 2.0.x through 2.0.10, update to version 2.0.11 or later.
For Django versions 2.1.x through 2.1.5, update to version 2.1.6 or later.
As a temporary workaround, consider restricting the use of the
django.utils.numberformat.format() function until a patch is applied.Correção
Allocation of Resources Without Limits
Resource Exhaustion
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Alt Linux
Django
Ubuntu