CVE-2018-7537 Django Denial-of-service possibility in truncatechars_html and truncatewords_html template filters
MediumCVSS 5.3
EPSS 4.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
An issue was discovered in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19. If django.utils.text.Truncator's chars() and words() methods were passed the html=True argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking vulnerability in a regular expression. The chars() and words() methods are used to implement the truncatechars_html and truncatewords_html template filters, which were thus vulnerable.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi django(PyPI) | >= 2.0, < 2.0.3 | 2.0.3 |
| pypi django(PyPI) | = 2.0 | No fix listed |
| pypi django(PyPI) | = 2.0.1 | No fix listed |
| pypi django(PyPI) | = 2.0.2 | No fix listed |
| pypi django(PyPI) | >= 1.11, < 1.11.11 | 1.11.11 |
| pypi django(PyPI) | = 1.11 | No fix listed |
| pypi django(PyPI) | = 1.11.1 | No fix listed |
| pypi django(PyPI) | = 1.11.10 | No fix listed |
| pypi django(PyPI) | = 1.11.2 | No fix listed |
| pypi django(PyPI) | = 1.11.3 | No fix listed |
| pypi django(PyPI) | = 1.11.4 | No fix listed |
| pypi django(PyPI) | = 1.11.5 | No fix listed |
| pypi django(PyPI) | = 1.11.6 | No fix listed |
| pypi django(PyPI) | = 1.11.7 | No fix listed |
| pypi django(PyPI) | = 1.11.8 | No fix listed |
| pypi django(PyPI) | = 1.11.9 | No fix listed |
| pypi django(PyPI) | >= 1.8, < 1.8.19 | 1.8.19 |
| pypi django(PyPI) | = 1.8 | No fix listed |
| pypi django(PyPI) | = 1.8.1 | No fix listed |
| pypi django(PyPI) | = 1.8.10 | No fix listed |
| pypi django(PyPI) | = 1.8.11 | No fix listed |
| pypi django(PyPI) | = 1.8.12 | No fix listed |
| pypi django(PyPI) | = 1.8.13 | No fix listed |
| pypi django(PyPI) | = 1.8.14 | No fix listed |
| pypi django(PyPI) | = 1.8.15 | No fix listed |
Show 44 more
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi django(PyPI) | = 1.8.16 | No fix listed |
| pypi django(PyPI) | = 1.8.17 | No fix listed |
| pypi django(PyPI) | = 1.8.18 | No fix listed |
| pypi django(PyPI) | = 1.8.2 | No fix listed |
| pypi django(PyPI) | = 1.8.3 | No fix listed |
| pypi django(PyPI) | = 1.8.4 | No fix listed |
| pypi django(PyPI) | = 1.8.5 | No fix listed |
| pypi django(PyPI) | = 1.8.6 | No fix listed |
| pypi django(PyPI) | = 1.8.7 | No fix listed |
| pypi django(PyPI) | = 1.8.8 | No fix listed |
| pypi django(PyPI) | = 1.8.9 | No fix listed |
| debian/python-django(Debian:12) | < 1:1.11.11-1 | 1:1.11.11-1 |
| debian/python-django(Debian:13) | < 1:1.11.11-1 | 1:1.11.11-1 |
| debian/python-django(Debian:14) | < 1:1.11.11-1 | 1:1.11.11-1 |
| Canonical Ubuntu Linux | = 14.04 | No fix listed |
| Canonical Ubuntu Linux | = 16.04 | No fix listed |
| Canonical Ubuntu Linux | = 17.10 | No fix listed |
| djangoproject django | >= 1.8, < 1.8.19 | 1.8.19 |
| djangoproject django | >= 1.11, < 1.11.11 | 1.11.11 |
| djangoproject django | >= 2.0, < 2.0.3 | 2.0.3 |
| debian linux | = 7.0 | No fix listed |
| debian linux | = 8.0 | No fix listed |
| debian linux | = 9.0 | No fix listed |
| alpine/py-django(Alpine:v3.10) | < 1.11.11-r0 | 1.11.11-r0 |
| alpine/py-django(Alpine:v3.4) | < 1.8.19-r0 | 1.8.19-r0 |
| alpine/py-django(Alpine:v3.5) | < 1.8.19-r0 | 1.8.19-r0 |
| alpine/py-django(Alpine:v3.6) | < 1.11.11-r0 | 1.11.11-r0 |
| alpine/py-django(Alpine:v3.7) | < 1.11.11-r0 | 1.11.11-r0 |
| alpine/py-django(Alpine:v3.8) | < 1.11.11-r0 | 1.11.11-r0 |
| alpine/py-django(Alpine:v3.9) | < 1.11.11-r0 | 1.11.11-r0 |
| alpine/py3-django(Alpine:v3.11) | < 1.11.11-r0 | 1.11.11-r0 |
| alpine/py3-django(Alpine:v3.12) | < 1.11.11-r0 | 1.11.11-r0 |
| alpine/py3-django(Alpine:v3.13) | < 1.11.11-r0 | 1.11.11-r0 |
| alpine/py3-django(Alpine:v3.14) | < 1.11.11-r0 | 1.11.11-r0 |
| alpine/py3-django(Alpine:v3.15) | < 1.11.11-r0 | 1.11.11-r0 |
| alpine/py3-django(Alpine:v3.16) | < 1.11.11-r0 | 1.11.11-r0 |
| alpine/py3-django(Alpine:v3.17) | < 1.11.11-r0 | 1.11.11-r0 |
| alpine/py3-django(Alpine:v3.18) | < 1.11.11-r0 | 1.11.11-r0 |
| alpine/py3-django(Alpine:v3.19) | < 1.11.11-r0 | 1.11.11-r0 |
| alpine/py3-django(Alpine:v3.20) | < 1.11.11-r0 | 1.11.11-r0 |
| alpine/py3-django(Alpine:v3.21) | < 1.11.11-r0 | 1.11.11-r0 |
| alpine/py3-django(Alpine:v3.22) | < 1.11.11-r0 | 1.11.11-r0 |
| alpine/py3-django(Alpine:v3.23) | < 1.11.11-r0 | 1.11.11-r0 |
| alpine/py3-django(Alpine:v3.24) | < 1.11.11-r0 | 1.11.11-r0 |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- github.com patch
- github.com patch
- RHSA-2018:2927 third-party-advisory vendor-advisory
- RHSA-2019:0265 third-party-advisory vendor-advisory
- github.com vendor-advisory
- github.com product
- github.com
- [debian-lts-announce] 20180308 [SECURITY] [DLA 1303-1] python-django security update mailing-list third-party-advisory
- USN-3591-1 third-party-advisory vendor-advisory
- DSA-4161 third-party-advisory vendor-advisory
- www.djangoproject.com release-notes technical-description vendor-advisory
- 103357 third-party-advisory vdb-entry
- Debian Security Tracker CVE-2018-7537 vendor-advisory
- security.alpinelinux.org vendor-advisory