Resource exhaustion in Django - CVE-2019-6975

Detailed vulnerability description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper memory operations that exist when the django.utils.numberformat.format() function receives a decimal with a large number of digits or a large component. A remote attacker can send a request that submits malicious input, consume excessive amounts of memory resources, resulting in a DoS condition.

How to mitigate CVE-2019-6975

Sources

• https://docs.djangoproject.com/en/dev/releases/security/
• https://groups.google.com/forum/#!topic/django-announce/WTwEAprR0IQ
• https://www.djangoproject.com/weblog/2019/feb/11/security-releases/
• https://www.openwall.com/lists/oss-security/2019/02/11/1