Bug 1673642 (CVE-2019-6975)
| Summary: | CVE-2019-6975 python-django: memory exhaustion in django.utils.numberformat.format() | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Laura Pardo <lpardo> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | apevec, bbuckingham, bcourt, bkearney, jakub.dornak, jal233, jjoyce, jschluet, lhh, lpeer, mburns, mhroncok, michel, mmccune, mrunge, ohadlevy, rchan, rjerrido, sclewis, security-response-team, sgallagh, sisharma, slinaber |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2021-10-27 03:23:03 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1686074, 1676321, 1676322, 1676323, 1676324, 1676325, 1676326, 1676327, 1676328, 1677295, 1677296, 1677297, 1678264, 1678265, 1678266 | ||
| Bug Blocks: | 1673649 | ||
Acknowledgments: Name: the Django project The associated Django releases are now public https://www.djangoproject.com/weblog/2019/feb/11/security-releases/ All versions of python-django supplied by Red Hat OpenStack Platform (1.6.11, 1.8.14, 1.8.18, & 1.11.10) are susceptible. Ceph and Gluster are affected since the shipped versions of python-django includes unpatched source code. Ceph(2,3) : python-django-1.8.18-1.el7ost Gluster : python-django-1.11.15-4.el7rhgs Created django:1.6/python-django tracking bugs for this issue: Affects: fedora-all [bug 1678266] Created python-django tracking bugs for this issue: Affects: epel-7 [bug 1678265] Affects: fedora-all [bug 1678264] Upstream patches: [1.11.x branch] https://github.com/django/django/commit/0bbb560183fabf0533289700845dafa94951f227 [2.0.x branch] https://github.com/django/django/commit/1f42f82566c9d2d73aff1c42790d6b1b243f7676 [2.1.x branch] https://github.com/django/django/commit/40cd19055773705301c3428ed5e08a036d2091f3 [2.2.x branch] https://github.com/django/django/commit/83ab3e26647f6a50cdfac01ecf735cad540b2f35 Statement: This issue did not affect the versions of python-django as shipped with Red Hat Update Infrastructure 3 as the vulnerable code is not present. Although Red Hat Satellite 6 uses the vulnerable component python-django, it does not use the module django.utils.numberformat, so it's not possible to trigger this vulnerability. Hence, Red Hat Satellite 6 is not vulnerable to this issue. In Red Hat OpenStack Platform, because the flaw has a lower impact and the fix would require a substantial amount of development, no update will be provided at this time for the RHOSP python-django package. |
A vulnerability was found in Django before versions 2.2b1, 2.1.6, 2.0.11, 1.11.19. If django.utils.numberformat.format(), used by contrib.admin as well as the the floatformat, filesizeformat, and intcomma templates filters, received a Decimal with a large number of digits or a large exponent, it could lead to significant memory usage due to a call to '{:f}'.format(). To avoid this, decimals with more than 200 digits are now formatted using scientific notation. References: https://www.djangoproject.com/security/