Bugzilla – Bug 1124991
VUL-0: CVE-2019-6975: python-Django: Memory exhaustion in django.utils.numberformat.format()
Last modified: 2020-08-04 06:35:51 UTC
CVE-2019-6975: If django.utils.numberformat.format() -- used by contrib.admin as well as the the floatformat, filesizeformat, and intcomma templates filters -- received a Decimal with a large number of digits or a large exponent, it could lead to significant memory usage due to a call to '{:f}'.format(). To avoid this, decimals with more than 200 digits are now formatted using scientific notation. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-6975 http://seclists.org/oss-sec/2019/q1/118
Assuming these codestreams affected: - SUSE:SLE-12-SP2:Update:Products:Cloud7:Update - SUSE:SLE-12-SP2:Update:Products:SES4:Update - SUSE:SLE-12-SP3:Update:Products:Cloud8:Update - SUSE:SLE-12-SP3:Update:Products:SES5:Update
This is an autogenerated message for OBS integration: This bug (1124991) was mentioned in https://build.opensuse.org/request/show/673591 Factory / python-Django
This is an autogenerated message for OBS integration: This bug (1124991) was mentioned in https://build.opensuse.org/request/show/678815 Factory / python-Django1
cloud8/9 submitted as that could be fixed by a plain version update. cloud7 will require somebody with skills to backport the security patch, so leaving that open to bryan for now.
SUSE-SU-2019:1215-1: An update that fixes one vulnerability is now available. Category: security (moderate) Bug References: 1124991 CVE References: CVE-2019-6975 Sources used: SUSE OpenStack Cloud Crowbar 9 (src): python-Django1-1.11.20-3.3.1 SUSE OpenStack Cloud 9 (src): python-Django1-1.11.20-3.3.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Security fix back-ported to Cloud 7 with request id 193693.
SUSE-SU-2019:2042-1: An update that fixes one vulnerability is now available. Category: security (moderate) Bug References: 1124991 CVE References: CVE-2019-6975 Sources used: SUSE OpenStack Cloud 7 (src): python-Django-1.8.19-3.12.5 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
looks like the old version of django (1.6) is not affected: - SUSE:SLE-12-SP2:Update:Products:SES4:Update - SUSE:SLE-12-SP3:Update:Products:SES5:Update
released