PT-2019-4623 · Django+2 · Django+2
Sjoerd Job Postmus
·
Published
2019-02-10
·
Updated
2026-01-03
·
CVE-2019-6975
CVSS v4.0
8.7
High
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
Django versions 1.11.x through 1.11.18
Django versions 2.0.x through 2.0.10
Django versions 2.1.x through 2.1.5
Description
The issue is related to uncontrolled memory consumption, which can lead to a complete depletion of resources, potentially causing a denial of service. This can be triggered by a malicious attacker-supplied value to the
django.utils.numberformat.format() function. The vulnerability can be exploited by a remote attacker.Recommendations
For Django versions 1.11.x through 1.11.18, update to version 1.11.19 or later.
For Django versions 2.0.x through 2.0.10, update to version 2.0.11 or later.
For Django versions 2.1.x through 2.1.5, update to version 2.1.6 or later.
As a temporary workaround, consider restricting the use of the
django.utils.numberformat.format() function until a patch is applied.Fix
Allocation of Resources Without Limits
Resource Exhaustion
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Django
Ubuntu