CVE-2018-7537

NameCVE-2018-7537
DescriptionAn issue was discovered in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19. If django.utils.text.Truncator's chars() and words() methods were passed the html=True argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking vulnerability in a regular expression. The chars() and words() methods are used to implement the truncatechars_html and truncatewords_html template filters, which were thus vulnerable.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub advisories/code/issues, web search, more)
ReferencesDLA-1303-1, DSA-4161-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
python-django (PTS)buster, buster (security)1:1.11.29-1~deb10u1fixed
bullseye2:2.2.26-1~deb11u1fixed
bookworm, sid3:3.2.15-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
python-djangosourcewheezy1.4.22-1+deb7u4DLA-1303-1
python-djangosourcejessie1.7.11-1+deb8u3DSA-4161-1
python-djangosourcestretch1:1.10.7-2+deb9u1DSA-4161-1
python-djangosource(unstable)1:1.11.11-1

Notes

https://www.djangoproject.com/weblog/2018/mar/06/security-releases/
Patch https://github.com/django/django/commit/a91436360b79a6ff995c3e5018bcc666dfaf1539

Search for package or bug name: Reporting problems