Description
An issue was discovered in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19. If django.utils.text.Truncator's chars() and words() methods were passed the html=True argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking vulnerability in a regular expression. The chars() and words() methods are used to implement the truncatechars_html and truncatewords_html template filters, which were thus vulnerable.
Published: 2018-03-09
Score: 5.3 Medium
EPSS: 2.1% Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-1303-1 python-django security update
Debian DLA Debian DLA DLA-2233-1 python-django security update
Debian DSA Debian DSA DSA-4161-1 python-django security update
EUVD EUVD EUVD-2018-0041 An issue was discovered in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19. If django.utils.text.Truncator's chars() and words() methods were passed the html=True argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking vulnerability in a regular expression. The chars() and words() methods are used to implement the truncatechars_html and truncatewords_html template filters, which were thus vulnerable.
Github GHSA Github GHSA GHSA-2f9x-5v75-3qv4 Django Denial-of-service possibility in truncatechars_html and truncatewords_html template filters
Ubuntu USN Ubuntu USN USN-3591-1 Django vulnerabilities
History

No history.

Subscriptions

Canonical Ubuntu Linux
Debian Debian Linux
Djangoproject Django
Redhat Satellite Satellite Capsule Storage
cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2024-08-05T06:31:04.518Z

Reserved: 2018-02-26T00:00:00.000Z

Link: CVE-2018-7537

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2018-03-09T20:29:00.660

Modified: 2024-11-21T04:12:19.227

Link: CVE-2018-7537

cve-icon Redhat

Severity : Moderate

Publid Date: 2018-03-06T00:00:00Z

Links: CVE-2018-7537 - Bugzilla

cve-icon OpenCVE Enrichment

No data.

Weaknesses