PT-2018-1903 · Django+1 · Django+1
James Davis
·
Publicado
2018-03-06
·
Atualizado
2026-01-03
·
CVE-2018-7537
CVSS v3.1
5.3
Média
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
Name of the Vulnerable Software and Affected Versions
Django versions 2.0 before 2.0.3
Django versions 1.11 before 1.11.11
Django versions 1.8 before 1.8.19
Description
The issue is related to a catastrophic backtracking vulnerability in a regular expression used by the
django.utils.text.Truncator class, specifically in its chars() and words() methods when the html=True argument is passed. This vulnerability affects the truncatechars html and truncatewords html template filters. An attacker could exploit this by crafting a string that leads to a denial of service.Recommendations
For Django versions 2.0 before 2.0.3, update to version 2.0.3 or later.
For Django versions 1.11 before 1.11.11, update to version 1.11.11 or later.
For Django versions 1.8 before 1.8.19, update to version 1.8.19 or later.
As a temporary workaround, consider avoiding the use of the
html=True argument in the chars() and words() methods of django.utils.text.Truncator until a patch is applied.Correção
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Django
Ubuntu