Django 2.0.11 版本发行说明
CVE-2019-6975: Memory exhaustion in
2019 年 2 月 11 日
Django 2.0.11 fixes a security issue in 2.0.10.
CVE-2019-6975: Memory exhaustion in django.utils.numberformat.format()
If django.utils.numberformat.format()
-- used by contrib.admin
as well
as the floatformat
, filesizeformat
, and intcomma
templates filters
-- received a Decimal
with a large number of digits or a large exponent, it
could lead to significant memory usage due to a call to '{:f}'.format()
.
To avoid this, decimals with more than 200 digits are now formatted using scientific notation.
讨论区