Django 2.1.6 版本发行说明
CVE-2019-6975: Memory exhaustion in
2019 年 2 月 11 日
Django 2.1.6 fixes a security issue and a bug in 2.1.5.
CVE-2019-6975: Memory exhaustion in django.utils.numberformat.format()
If django.utils.numberformat.format()
-- used by contrib.admin
as well
as the floatformat
, filesizeformat
, and intcomma
templates filters
-- received a Decimal
with a large number of digits or a large exponent, it
could lead to significant memory usage due to a call to '{:f}'.format()
.
To avoid this, decimals with more than 200 digits are now formatted using scientific notation.
漏洞修复
- Made the
obj
argument ofInlineModelAdmin.has_add_permission()
optional to restore backwards compatibility with third-party code that doesn't provide it (#30097).
讨论区