Описание
Django 1.11.x before 1.11.19, 2.0.x before 2.0.11, and 2.1.x before 2.1.6 allows Uncontrolled Memory Consumption via a malicious attacker-supplied value to the django.utils.numberformat.format() function.
Отчет
This issue did not affect the versions of python-django as shipped with Red Hat Update Infrastructure 3 as the vulnerable code is not present. Although Red Hat Satellite 6 uses the vulnerable component python-django, it does not use the module django.utils.numberformat, so it's not possible to trigger this vulnerability. Hence, Red Hat Satellite 6 is not vulnerable to this issue. In Red Hat OpenStack Platform, because the flaw has a lower impact and the fix would require a substantial amount of development, no update will be provided at this time for the RHOSP python-django package.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Ceph Storage 2 | python-django | Affected | ||
| Red Hat Ceph Storage 3 | python-django | Affected | ||
| Red Hat Certification for Red Hat Enterprise Linux 7 | python-django | Affected | ||
| Red Hat OpenStack Platform 10 (Newton) | python-django | Will not fix | ||
| Red Hat OpenStack Platform 13 (Queens) | python-django | Will not fix | ||
| Red Hat OpenStack Platform 14 (Rocky) | python-django | Will not fix | ||
| Red Hat OpenStack Platform 15 (Stein) | python-django | Will not fix | ||
| Red Hat OpenStack Platform 8 (Liberty) | python-django | Will not fix | ||
| Red Hat OpenStack Platform 8 (Liberty) Operational Tools | python-django | Will not fix | ||
| Red Hat OpenStack Platform 9 (Mitaka) | python-django | Will not fix |
Показывать по
Дополнительная информация
Статус:
EPSS
5.3 Medium
CVSS3
Связанные уязвимости
Django 1.11.x before 1.11.19, 2.0.x before 2.0.11, and 2.1.x before 2.1.6 allows Uncontrolled Memory Consumption via a malicious attacker-supplied value to the django.utils.numberformat.format() function.
Django 1.11.x before 1.11.19, 2.0.x before 2.0.11, and 2.1.x before 2.1.6 allows Uncontrolled Memory Consumption via a malicious attacker-supplied value to the django.utils.numberformat.format() function.
Django 1.11.x before 1.11.19, 2.0.x before 2.0.11, and 2.1.x before 2. ...
Уязвимость функции django.utils.numberformat.format() фреймворка для веб-разработки Django, позволяющая нарушителю вызвать отказ в обслуживании
EPSS
5.3 Medium
CVSS3