CVE-2018-7537

Name	CVE-2018-7537
Description	An issue was discovered in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19. If django.utils.text.Truncator's chars() and words() methods were passed the html=True argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking vulnerability in a regular expression. The chars() and words() methods are used to implement the truncatechars_html and truncatewords_html template filters, which were thus vulnerable.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-1303-1, DSA-4161-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
python-django (PTS)	bullseye (security), bullseye	2:2.2.28-1~deb11u2	fixed
	bookworm, bookworm (security)	3:3.2.19-1+deb12u1	fixed
	sid, trixie	3:4.2.16-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin
python-django	source	wheezy	1.4.22-1+deb7u4	DLA-1303-1
python-django	source	jessie	1.7.11-1+deb8u3	DSA-4161-1
python-django	source	stretch	1:1.10.7-2+deb9u1	DSA-4161-1
python-django	source	(unstable)	1:1.11.11-1

Notes

https://www.djangoproject.com/weblog/2018/mar/06/security-releases/
Patch https://github.com/django/django/commit/a91436360b79a6ff995c3e5018bcc666dfaf1539