CVE-2018-7537

NameCVE-2018-7537
DescriptionAn issue was discovered in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19. If django.utils.text.Truncator's chars() and words() methods were passed the html=True argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking vulnerability in a regular expression. The chars() and words() methods are used to implement the truncatechars_html and truncatewords_html template filters, which were thus vulnerable.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
ReferencesDLA-1303-1, DSA-4161-1
NVD severitymedium (attack range: remote)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
python-django (PTS)jessie (security), jessie1.7.11-1+deb8u3fixed
stretch1:1.10.7-2+deb9u3fixed
stretch (security)1:1.10.7-2+deb9u2fixed
buster, sid1:1.11.17-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
python-djangosource(unstable)1:1.11.11-1medium
python-djangosourcejessie1.7.11-1+deb8u3mediumDSA-4161-1
python-djangosourcestretch1:1.10.7-2+deb9u1mediumDSA-4161-1
python-djangosourcewheezy1.4.22-1+deb7u4mediumDLA-1303-1

Notes

https://www.djangoproject.com/weblog/2018/mar/06/security-releases/
Patch https://github.com/django/django/commit/a91436360b79a6ff995c3e5018bcc666dfaf1539

Search for package or bug name: Reporting problems