Bug 1673642 (CVE-2019-6975)
Summary: | CVE-2019-6975 python-django: memory exhaustion in django.utils.numberformat.format() | ||
---|---|---|---|
Product: | [Other] Security Response | Reporter: | Laura Pardo <lpardo> |
Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
Status: | CLOSED ERRATA | QA Contact: | |
Severity: | medium | Docs Contact: | |
Priority: | medium | ||
Version: | unspecified | CC: | apevec, bbuckingham, bcourt, bkearney, jakub.dornak, jal233, jjoyce, jschluet, lhh, lpeer, mburns, mhroncok, michel, mmccune, mrunge, ohadlevy, rchan, rjerrido, sclewis, security-response-team, sgallagh, sisharma, slinaber |
Target Milestone: | --- | Keywords: | Security |
Target Release: | --- | ||
Hardware: | All | ||
OS: | Linux | ||
Whiteboard: | |||
Fixed In Version: | Doc Type: | If docs needed, set a value | |
Doc Text: | Story Points: | --- | |
Clone Of: | Environment: | ||
Last Closed: | 2021-10-27 03:23:03 UTC | Type: | --- |
Regression: | --- | Mount Type: | --- |
Documentation: | --- | CRM: | |
Verified Versions: | Category: | --- | |
oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
Cloudforms Team: | --- | Target Upstream Version: | |
Embargoed: | |||
Bug Depends On: | 1686074, 1676321, 1676322, 1676323, 1676324, 1676325, 1676326, 1676327, 1676328, 1677295, 1677296, 1677297, 1678264, 1678265, 1678266 | ||
Bug Blocks: | 1673649 |
Description
Laura Pardo
2019-02-07 16:43:23 UTC
Acknowledgments: Name: the Django project The associated Django releases are now public https://www.djangoproject.com/weblog/2019/feb/11/security-releases/ All versions of python-django supplied by Red Hat OpenStack Platform (1.6.11, 1.8.14, 1.8.18, & 1.11.10) are susceptible. Ceph and Gluster are affected since the shipped versions of python-django includes unpatched source code. Ceph(2,3) : python-django-1.8.18-1.el7ost Gluster : python-django-1.11.15-4.el7rhgs Created django:1.6/python-django tracking bugs for this issue: Affects: fedora-all [bug 1678266] Created python-django tracking bugs for this issue: Affects: epel-7 [bug 1678265] Affects: fedora-all [bug 1678264] Upstream patches: [1.11.x branch] https://github.com/django/django/commit/0bbb560183fabf0533289700845dafa94951f227 [2.0.x branch] https://github.com/django/django/commit/1f42f82566c9d2d73aff1c42790d6b1b243f7676 [2.1.x branch] https://github.com/django/django/commit/40cd19055773705301c3428ed5e08a036d2091f3 [2.2.x branch] https://github.com/django/django/commit/83ab3e26647f6a50cdfac01ecf735cad540b2f35 Statement: This issue did not affect the versions of python-django as shipped with Red Hat Update Infrastructure 3 as the vulnerable code is not present. Although Red Hat Satellite 6 uses the vulnerable component python-django, it does not use the module django.utils.numberformat, so it's not possible to trigger this vulnerability. Hence, Red Hat Satellite 6 is not vulnerable to this issue. In Red Hat OpenStack Platform, because the flaw has a lower impact and the fix would require a substantial amount of development, no update will be provided at this time for the RHOSP python-django package. |