CVE-2018-7536

Name	CVE-2018-7536
Description	An issue was discovered in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19. The django.utils.html.urlize() function was extremely slow to evaluate certain inputs due to catastrophic backtracking vulnerabilities in two regular expressions (only one regular expression for Django 1.8.x). The urlize() function is used to implement the urlize and urlizetrunc template filters, which were thus vulnerable.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-1303-1, DSA-4161-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
python-django (PTS)	bullseye (security), bullseye	2:2.2.28-1~deb11u2	fixed
	bookworm, bookworm (security)	3:3.2.19-1+deb12u1	fixed
	trixie	3:4.2.16-1	fixed
	sid	3:4.2.17-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin
python-django	source	wheezy	1.4.22-1+deb7u4	DLA-1303-1
python-django	source	jessie	1.7.11-1+deb8u3	DSA-4161-1
python-django	source	stretch	1:1.10.7-2+deb9u1	DSA-4161-1
python-django	source	(unstable)	1:1.11.11-1

Notes

https://www.djangoproject.com/weblog/2018/mar/06/security-releases/
Patch https://github.com/django/django/commit/abf89d729f210c692a50e0ad3f75fb6bec6fae16