A vulnerability was found in Django before versions 2.2b1, 2.1.6, 2.0.11, 1.11.19. If django.utils.numberformat.format(), used by contrib.admin as well as the the floatformat, filesizeformat, and intcomma templates filters, received a Decimal with a large number of digits or a large exponent, it could lead to significant memory usage due to a call to '{:f}'.format(). To avoid this, decimals with more than 200 digits are now formatted using scientific notation. References: https://www.djangoproject.com/security/
Acknowledgments: Name: the Django project
The associated Django releases are now public https://www.djangoproject.com/weblog/2019/feb/11/security-releases/
All versions of python-django supplied by Red Hat OpenStack Platform (1.6.11, 1.8.14, 1.8.18, & 1.11.10) are susceptible.
Ceph and Gluster are affected since the shipped versions of python-django includes unpatched source code. Ceph(2,3) : python-django-1.8.18-1.el7ost Gluster : python-django-1.11.15-4.el7rhgs
Created django:1.6/python-django tracking bugs for this issue: Affects: fedora-all [bug 1678266] Created python-django tracking bugs for this issue: Affects: epel-7 [bug 1678265] Affects: fedora-all [bug 1678264]
Upstream patches: [1.11.x branch] https://github.com/django/django/commit/0bbb560183fabf0533289700845dafa94951f227 [2.0.x branch] https://github.com/django/django/commit/1f42f82566c9d2d73aff1c42790d6b1b243f7676 [2.1.x branch] https://github.com/django/django/commit/40cd19055773705301c3428ed5e08a036d2091f3 [2.2.x branch] https://github.com/django/django/commit/83ab3e26647f6a50cdfac01ecf735cad540b2f35
Statement: This issue did not affect the versions of python-django as shipped with Red Hat Update Infrastructure 3 as the vulnerable code is not present. Although Red Hat Satellite 6 uses the vulnerable component python-django, it does not use the module django.utils.numberformat, so it's not possible to trigger this vulnerability. Hence, Red Hat Satellite 6 is not vulnerable to this issue. In Red Hat OpenStack Platform, because the flaw has a lower impact and the fix would require a substantial amount of development, no update will be provided at this time for the RHOSP python-django package.