CVE-2019-6975

Django 1.11.x before 1.11.19, 2.0.x before 2.0.11, and 2.1.x before 2.1.6 allows Uncontrolled Memory Consumption via a malicious attacker-supplied value to the django.utils.numberformat.format() function.

Django 1.11.x before 1.11.19, 2.0.x before 2.0.11, and 2.1.x before 2.1.6 allows Uncontrolled Memory Consumption via a malicious attacker-supplied value to the django.utils.numberformat.format() function.

Django 1.11.x before 1.11.19, 2.0.x before 2.0.11, and 2.1.x before 2.1.6 allows Uncontrolled Memory Consumption via a malicious attacker-supplied value to the django.utils.numberformat.format() function.

If django.utils.numberformat.format() -- used by contrib.admin as well as the floatformat, filesizeformat, and intcomma templates filters -- received a Decimal with a large number of digits or a large exponent, it could lead to significant memory usage due to a call to '{:f}'.format() (CVE-2019-6975).

These are all security issues fixed in the python36-Django-3.2.7-2.3 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python310-Django-4.2.11-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python310-Django4-4.2.14-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python312-Django6-6.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python313-Django4-4.2.30-4.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python313-Django-5.2.16-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python313-Django5-5.2.16-1.1 package on the GA media of openSUSE Tumbleweed.

Django 1.11.x before 1.11.19, 2.0.x before 2.0.11, and 2.1.x before 2.1.6 allows Uncontrolled Memory Consumption via a malicious attacker-supplied value to the django.utils.numberformat.format() function.

This update for python-Django1 fixes the following issue:

Security issue fixed:

• CVE-2019-6975: Fixed memory exhaustion in django.utils.numberformat.format() (bsc#1124991).

This update for ardana and crowbar fixes the following issues:

• Restrict rootwrap directories for cinder (bsc#1132542)
• Change Cinder default log level from DEBUG to INFO (SCRD-7132)
• Remove configuration from migration (bsc#1126391)
• Configurable innodb flush options (SCRD-7496)
• Secure designate's rootwrap files (bsc#1132542)
• specify rootwrap config file in designate sudoer (bsc#1132542)
• Update Designate log threshold from DEBUG to INFO (SCRD-8459)
• Change Glance default log level from DEBUG to INFO (SCRD-8592)
• Change Heat default log level from DEBUG to INFO (SCRD-7132)
• Fix Horizon missing create snapshot action for users (bsc#1130593)
• Don't set external-name in ardana-ci models (SCRD-7471)
• Fix fail-over/-back behavior of haproxy for galera (bsc#1122875)
• Update swift endpoints from keystone-reconfigure.yml if needed (SCRD-8703)
• Change Magnum default log level from DEFAULT to INFO (SCRD-7132)
• Rip out vertica related code (SCRD-9031)
• Tighten neutron sudoers to only execute rootwrap (bsc#1132542)
• Change Neutron default log level from DEBUG to INFO (SCRD-7132)
• SCRD-9031 Change permitted nova-rootwrap config file pattern (bsc#1132542)
• specify rootwrap config file in nova sudoer (bsc#1132542)
• Change Nova default log level from DEBUG to INFO (SCRD-7132)
• Stop installing a sudoers root escalator (SCRD-9031)
• Change Octavia default log level from DEBUG to INFO (SCRD-7132)
• Increase number of connect retries (SCRD-7496)
• UDEV rules for multi-port nics (SCRD-8329)
• Ensure that the ceph group exists (SCRD-8347)
• Disable test_create_health_monitor_with_scenarios tempest (SOC-9176)
• Make --os-test-timeout configurable and increase default (SCRD-7496)
• Disable TestVolumeBootPattern.test_volume_boot_pattern (SCRD-9015)
• Increase and make timeout values configurable (SCRD-7496)
• Configure heat boot config template path (SCRD-7496)
• Fix typo on ceilometer filter (SCRD-7496)
• barclamp: Fix setting MTU on networks using a bridge
• Fix order of values in nodes piechart
• Ignore CVE-2019-11068 during Travis (SOC-9262)
• Fix cloud-mkcloud9-job-backup-restore (SCRD-7126)
• Update suse-branding.patch with correct links for documentation (SCRD-8294)
• pacemaker: add failure nodes to sync fail message (bsc#1083721)
• update suse-branding.patch (SOC-9297)
• pacemaker: wait more for founder if SBD is configured (SCRD-8462)
• pacemaker: don't check cluster members on founder (SCRD-8462)
• database: Make wsrep_provider_options configurable (fate#327745)
• database: Raise and align promote/demote timeouts (bsc#1131791)
• mysql: improve galera HA setup (bsc#1122875)
• Update suse-branding.patch with correct links for documentation (SCRD-8294)
• neutron: Fix the rest of the keystone related settings for LBaaS
• neutron: properly define neutron lbaas region (bsc#1128753)
• CLM - update MariaDB manually (bsc#1132852, SOC-9022)
• update MariaDB manually (bsc#1132852, SOC-9022)
• SOC8 alarm table restructure ((SCRD-7710, bsc#1124170)
• Fix bsc#1118003
• add deprecation decision tree (shrub) (SCRD-8530)
• add cert section (SCRD-5542)
• grammar; make migration pairing more explicit (SCRD-7595)
• Remove whitespace on top of login page (SCRD-7142)
• Revert alert and form colors to default SCRD-6919
• Change active sidebar section text white SCRD-6919
• Updated the openstack-monasca-agent-sudoers file (bsc#1132542)
• Don't restart neutron-ovs-cleanup on RPM update (bsc#1132860)
• Fix KeyError in OVS firewall (bsc#1131712, CVE-2019-10876)
• update to 1.11.20 (bsc#124991, CVE-2019-6975):
• Memory exhaustion in django.utils.numberformat.format()
• Include ops-console logs if exist (bsc-1126912)
• Add a sed pattern to censor passwords from servers.yml (bsc#1105559)
• Show the status file of crowbar upgrade (if it exists)

This update for python-Django fixes the following issues:

• Fixed CVE-2019-6975 (bsc#1124991)
  • Added CVE-2019-6975.patch to fix uncontrolled memory consumption
  • If django.utils.numberformat.format() -- used by contrib.admin as well as the the floatformat, filesizeformat, and intcomma templates filters -- received a Decimal with a large number of digits or a large exponent, it could lead to significant memory usage due to a call to '{:f}'.format(). To avoid this, decimals with more than 200 digits are now formatted using scientific notation.

It was discovered that Django incorrectly handled formatting certain numbers. A remote attacker could possibly use this issue to cause Django to consume resources, leading to a denial of service.