CVE-2019-6975

Published: Feb 11, 2019Modified: Jun 17, 2026

7.5

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

Django 1.11.x before 1.11.19, 2.0.x before 2.0.11, and 2.1.x before 2.1.6 allows Uncontrolled Memory Consumption via a malicious attacker-supplied value to the django.utils.numberformat.format() function.

Affected (8)

Products: Djangoproject: Django · Canonical: Ubuntu Linux · Fedoraproject: Fedora

1 product

1 product

1 product

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Djangoproject Django	From 1.11.0 to 1.11.19
Djangoproject Django	From 2.0.0 to 2.0.11
Djangoproject Django	From 2.1.0 to 2.1.6

Configuration B

3 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 16.04
Canonical Ubuntu Linux	Version 18.04
Canonical Ubuntu Linux	Version 18.10

Configuration C

2 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 28
Fedoraproject Fedora	Version 29

Related CWEs

CWE-770

Allocation of Resources Without Limits or Throttling

The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.

References (20)

http://www.securityfocus.com/bid/106964

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

https://docs.djangoproject.com/en/dev/releases/security/

Source: cve@mitre.org

PatchVendor Advisory

https://groups.google.com/forum/#%21topic/django-announce/WTwEAprR0IQ

Source: cve@mitre.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/66WMXHGBXD7GSM3PEXVCMCAGLMQYHZCU/

Source: cve@mitre.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HVXDOVCXLD74SHR2BENGCE2OOYYYWJHZ/

Source: cve@mitre.org

https://seclists.org/bugtraq/2019/Jul/10

Source: cve@mitre.org

https://usn.ubuntu.com/3890-1/

Source: cve@mitre.org

Third Party Advisory

https://www.debian.org/security/2019/dsa-4476

Source: cve@mitre.org

https://www.djangoproject.com/weblog/2019/feb/11/security-releases/

Source: cve@mitre.org

PatchVendor Advisory

https://www.openwall.com/lists/oss-security/2019/02/11/1

Source: cve@mitre.org

Mailing ListPatchThird Party Advisory

http://www.securityfocus.com/bid/106964