Django 1.11.19 版本发行说明
CVE-2019-6975: Memory exhaustion in
2019 年 2 月 11 日
Django 1.11.19 修复了 1.11.18 中的一个安全问题。
CVE-2019-6975: Memory exhaustion in django.utils.numberformat.format()
If django.utils.numberformat.format()
-- used by contrib.admin
as well
as the floatformat
, filesizeformat
, and intcomma
templates filters
-- received a Decimal
with a large number of digits or a large exponent, it
could lead to significant memory usage due to a call to '{:f}'.format()
.
To avoid this, decimals with more than 200 digits are now formatted using scientific notation.
讨论区