CVE-2018-7536 Django denial-of-service possibility in urlize and urlizetrunc template filters
MediumCVSS 5.3
EPSS 4.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
An issue was discovered in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19. The django.utils.html.urlize() function was extremely slow to evaluate certain inputs due to catastrophic backtracking vulnerabilities in two regular expressions (only one regular expression for Django 1.8.x). The urlize() function is used to implement the urlize and urlizetrunc template filters, which were thus vulnerable.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi django(PyPI) | >= 2.0a1, < 2.0.3 | 2.0.3 |
| pypi django(PyPI) | = 2.0 | No fix listed |
| pypi django(PyPI) | = 2.0.1 | No fix listed |
| pypi django(PyPI) | = 2.0.2 | No fix listed |
| pypi django(PyPI) | = 2.0a1 | No fix listed |
| pypi django(PyPI) | = 2.0b1 | No fix listed |
| pypi django(PyPI) | = 2.0rc1 | No fix listed |
| pypi django(PyPI) | >= 1.11a1, < 1.11.11 | 1.11.11 |
| pypi django(PyPI) | = 1.11 | No fix listed |
| pypi django(PyPI) | = 1.11.1 | No fix listed |
| pypi django(PyPI) | = 1.11.10 | No fix listed |
| pypi django(PyPI) | = 1.11.2 | No fix listed |
| pypi django(PyPI) | = 1.11.3 | No fix listed |
| pypi django(PyPI) | = 1.11.4 | No fix listed |
| pypi django(PyPI) | = 1.11.5 | No fix listed |
| pypi django(PyPI) | = 1.11.6 | No fix listed |
| pypi django(PyPI) | = 1.11.7 | No fix listed |
| pypi django(PyPI) | = 1.11.8 | No fix listed |
| pypi django(PyPI) | = 1.11.9 | No fix listed |
| pypi django(PyPI) | = 1.11a1 | No fix listed |
| pypi django(PyPI) | = 1.11b1 | No fix listed |
| pypi django(PyPI) | = 1.11rc1 | No fix listed |
| pypi django(PyPI) | >= 1.8a1, < 1.8.19 | 1.8.19 |
| pypi django(PyPI) | = 1.8 | No fix listed |
| pypi django(PyPI) | = 1.8.1 | No fix listed |
Show 59 more
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi django(PyPI) | = 1.8.10 | No fix listed |
| pypi django(PyPI) | = 1.8.11 | No fix listed |
| pypi django(PyPI) | = 1.8.12 | No fix listed |
| pypi django(PyPI) | = 1.8.13 | No fix listed |
| pypi django(PyPI) | = 1.8.14 | No fix listed |
| pypi django(PyPI) | = 1.8.15 | No fix listed |
| pypi django(PyPI) | = 1.8.16 | No fix listed |
| pypi django(PyPI) | = 1.8.17 | No fix listed |
| pypi django(PyPI) | = 1.8.18 | No fix listed |
| pypi django(PyPI) | = 1.8.2 | No fix listed |
| pypi django(PyPI) | = 1.8.3 | No fix listed |
| pypi django(PyPI) | = 1.8.4 | No fix listed |
| pypi django(PyPI) | = 1.8.5 | No fix listed |
| pypi django(PyPI) | = 1.8.6 | No fix listed |
| pypi django(PyPI) | = 1.8.7 | No fix listed |
| pypi django(PyPI) | = 1.8.8 | No fix listed |
| pypi django(PyPI) | = 1.8.9 | No fix listed |
| pypi django(PyPI) | = 1.8a1 | No fix listed |
| pypi django(PyPI) | = 1.8b1 | No fix listed |
| pypi django(PyPI) | = 1.8b2 | No fix listed |
| pypi django(PyPI) | = 1.8c1 | No fix listed |
| pypi django(PyPI) | >= 1.8, < 1.8.19 | 1.8.19 |
| pypi django(PyPI) | >= 1.11, < 1.11.11 | 1.11.11 |
| pypi django(PyPI) | >= 2.0, < 2.0.3 | 2.0.3 |
| debian/python-django(Debian:12) | < 1:1.11.11-1 | 1:1.11.11-1 |
| debian/python-django(Debian:13) | < 1:1.11.11-1 | 1:1.11.11-1 |
| debian/python-django(Debian:14) | < 1:1.11.11-1 | 1:1.11.11-1 |
| Canonical Ubuntu Linux | = 14.04 | No fix listed |
| Canonical Ubuntu Linux | = 16.04 | No fix listed |
| Canonical Ubuntu Linux | = 17.10 | No fix listed |
| djangoproject django | >= 1.8, < 1.8.19 | 1.8.19 |
| djangoproject django | >= 1.11, < 1.11.11 | 1.11.11 |
| djangoproject django | >= 2.0, < 2.0.3 | 2.0.3 |
| debian linux | = 7.0 | No fix listed |
| debian linux | = 8.0 | No fix listed |
| debian linux | = 9.0 | No fix listed |
| redhat openstack | = 10 | No fix listed |
| redhat openstack | = 13 | No fix listed |
| alpine/py-django(Alpine:v3.10) | < 1.11.11-r0 | 1.11.11-r0 |
| alpine/py-django(Alpine:v3.4) | < 1.8.19-r0 | 1.8.19-r0 |
| alpine/py-django(Alpine:v3.5) | < 1.8.19-r0 | 1.8.19-r0 |
| alpine/py-django(Alpine:v3.6) | < 1.11.11-r0 | 1.11.11-r0 |
| alpine/py-django(Alpine:v3.7) | < 1.11.11-r0 | 1.11.11-r0 |
| alpine/py-django(Alpine:v3.8) | < 1.11.11-r0 | 1.11.11-r0 |
| alpine/py-django(Alpine:v3.9) | < 1.11.11-r0 | 1.11.11-r0 |
| alpine/py3-django(Alpine:v3.11) | < 1.11.11-r0 | 1.11.11-r0 |
| alpine/py3-django(Alpine:v3.12) | < 1.11.11-r0 | 1.11.11-r0 |
| alpine/py3-django(Alpine:v3.13) | < 1.11.11-r0 | 1.11.11-r0 |
| alpine/py3-django(Alpine:v3.14) | < 1.11.11-r0 | 1.11.11-r0 |
| alpine/py3-django(Alpine:v3.15) | < 1.11.11-r0 | 1.11.11-r0 |
| alpine/py3-django(Alpine:v3.16) | < 1.11.11-r0 | 1.11.11-r0 |
| alpine/py3-django(Alpine:v3.17) | < 1.11.11-r0 | 1.11.11-r0 |
| alpine/py3-django(Alpine:v3.18) | < 1.11.11-r0 | 1.11.11-r0 |
| alpine/py3-django(Alpine:v3.19) | < 1.11.11-r0 | 1.11.11-r0 |
| alpine/py3-django(Alpine:v3.20) | < 1.11.11-r0 | 1.11.11-r0 |
| alpine/py3-django(Alpine:v3.21) | < 1.11.11-r0 | 1.11.11-r0 |
| alpine/py3-django(Alpine:v3.22) | < 1.11.11-r0 | 1.11.11-r0 |
| alpine/py3-django(Alpine:v3.23) | < 1.11.11-r0 | 1.11.11-r0 |
| alpine/py3-django(Alpine:v3.24) | < 1.11.11-r0 | 1.11.11-r0 |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- github.com patch
- github.com patch
- RHSA-2018:2927 third-party-advisory vendor-advisory
- RHSA-2019:0051 third-party-advisory vendor-advisory
- RHSA-2019:0082 third-party-advisory vendor-advisory
- RHSA-2019:0265 third-party-advisory vendor-advisory
- github.com vendor-advisory
- github.com product
- github.com
- [debian-lts-announce] 20180308 [SECURITY] [DLA 1303-1] python-django security update mailing-list third-party-advisory
- USN-3591-1 third-party-advisory vendor-advisory
- web.archive.org
- DSA-4161 third-party-advisory vendor-advisory
- www.djangoproject.com release-notes technical-description vendor-advisory
- 103361 third-party-advisory vdb-entry
- Debian Security Tracker CVE-2018-7536 vendor-advisory
- security.alpinelinux.org vendor-advisory