PT-2018-1903 · Django+1 · Django+1
James Davis
·
Published
2018-03-06
·
Updated
2026-01-03
·
CVE-2018-7537
CVSS v3.1
5.3
Medium
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
Name of the Vulnerable Software and Affected Versions
Django versions 2.0 before 2.0.3
Django versions 1.11 before 1.11.11
Django versions 1.8 before 1.8.19
Description
The issue is related to a catastrophic backtracking vulnerability in a regular expression used by the
django.utils.text.Truncator class, specifically in its chars() and words() methods when the html=True argument is passed. This vulnerability affects the truncatechars html and truncatewords html template filters. An attacker could exploit this by crafting a string that leads to a denial of service.Recommendations
For Django versions 2.0 before 2.0.3, update to version 2.0.3 or later.
For Django versions 1.11 before 1.11.11, update to version 1.11.11 or later.
For Django versions 1.8 before 1.8.19, update to version 1.8.19 or later.
As a temporary workaround, consider avoiding the use of the
html=True argument in the chars() and words() methods of django.utils.text.Truncator until a patch is applied.Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Django
Ubuntu