Resource exhaustion in Django - CVE-2019-6975

Vulnerability identifier: #VU17717

CSH Severity: Low

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-6975

CWE-ID: CWE-400

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper memory operations that exist when the django.utils.numberformat.format() function receives a decimal with a large number of digits or a large component. A remote attacker can send a request that submits malicious input, consume excessive amounts of memory resources, resulting in a DoS condition.

Django
python-django (Ubuntu package)
python-django (Debian package)
py-django (Alpine package)
python-django
python2-django1.11
Fedora

The vulnerability has been addressed in the versions 2.1.6, 2.0.11, 1.11.19.

Django - addressed in versions 1.11.19, 2.0.11, 2.1.6
python-django (Ubuntu package) - addressed in versions 1.8.7-1ubuntu5.8, 1:1.11.11-1ubuntu1.3, 1:1.11.15-1ubuntu1.2
python-django (Debian package) - update to 1:1.10.7-2+deb9u5
py-django (Alpine package) - update to 1.11.20-r0
python-django - addressed in versions 1.11.20-1.el7, 2.0.12-1.fc28, 2.0.12-1.fc29, 2.0.13-1.fc28, 2.0.13-1.fc29
python2-django1.11 - addressed in versions 1.11.20-1.fc28, 1.11.20-1.fc29

• https://docs.djangoproject.com/en/dev/releases/security/
• https://groups.google.com/forum/#!topic/django-announce/WTwEAprR0IQ
• https://www.djangoproject.com/weblog/2019/feb/11/security-releases/
• https://www.openwall.com/lists/oss-security/2019/02/11/1

• Denial of service in Django
• Ubuntu update for Django
• Debian update for python-django
• Resource exhaustion in py-django (Alpine package)
• Fedora 29 update for python-django
• Fedora 28 update for python-django
• Fedora EPEL 7 update for python-django
• Fedora 28 update for python-django
• Fedora 29 update for python-django
• Fedora 29 update for python2-django1.11
• Fedora 28 update for python2-django1.11