Django 1.11.x before 1.11.19, 2.0.x before 2.0.11, and 2.1.x before 2.1.6 allows Uncontrolled Memory Consumption via a malicious attacker-supplied value to the django.utils.numberformat.format() function.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Django 1.11.x before 1.11.19, 2.0.x before 2.0.11, and 2.1.x before 2.1.6 allows Uncontrolled Memory     Consumption via a malicious attacker-supplied value to the django.utils.numberformat.format() function.
    (CVE-2019-6975)

Note that Nessus relies on the presence of the package as reported by the vendor.

Three security issues were found in Django, a Python web development framework, which could result in denial of service, incomplete sanitisation of clickable links or missing redirects of HTTP requests to HTTPS.

Update to the 1.11.20 security fix release

Fixes CVE-2019-6975: Memory exhaustion in django.utils.numberformat.format()

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- CVE-2019-3498: Content spoofing possibility in the     default 404 page

  - CVE-2019-6975: Memory exhaustion in     django.utils.numberformat.format()

  - Fixed a race condition in QuerySet.update_or_create()     that could result in data loss

  - geo: Prevented repetitive calls to geos_version_tuple()     in the WKBWriter class

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

fix CVE-2019-6975: Memory exhaustion in django.utils.numberformat.format()

----

fix CVE-2019-6975: Memory exhaustion in django.utils.numberformat.format()

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3890-1 advisory.

    It was discovered that Django incorrectly handled formatting certain numbers. A remote attacker could     possibly use this issue to cause Django to consume resources, leading to a denial of service.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
223172	Linux Distros Unpatched Vulnerability : CVE-2019-6975	Nessus	Misc.	high
126514	Debian DSA-4476-1 : python-django - security update	Nessus	Debian Local Security Checks	medium
122986	Fedora 29 : python2-django1.11 (2019-f528d75a69)	Nessus	Fedora Local Security Checks	high
122980	Fedora 28 : python2-django1.11 (2019-5ad2149e99)	Nessus	Fedora Local Security Checks	medium
122562	Fedora 28 : python-django (2019-9760933547)	Nessus	Fedora Local Security Checks	high
122524	Fedora 29 : python-django (2019-ec55814c1c)	Nessus	Fedora Local Security Checks	high
122184	Ubuntu 16.04 LTS / 18.04 LTS : Django vulnerability (USN-3890-1)	Nessus	Ubuntu Local Security Checks	high

Detections

Analytics

CVE-2019-6975

high

Tenable Plugins

high

medium

high

medium

high

high

high