CVE-2018-7537

django: Catastrophic backtracking in regular expressions via 'truncatechars_html' and 'truncatewords_html'

Published Mar 9, 2018 CVSS 3.0 · 5.3 Medium EPSS 4.4% KEV · Not listed
Description
An issue was discovered in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19. If django.utils.text.Truncator's chars() and words() methods were passed the html=True argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking vulnerability in a regular expression. The chars() and words() methods are used to implement the truncatechars_html and truncatewords_html template filters, which were thus vulnerable.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DLA Debian DLA DLA-1303-1 python-django security update
Debian DLA Debian DLA DLA-2233-1 python-django security update
Debian DSA Debian DSA DSA-4161-1 python-django security update
EUVD EUVD EUVD-2018-0041 An issue was discovered in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19. If django.utils.text.Truncator's chars() and words() methods were passed the html=True argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking vulnerability in a regular expression. The chars() and words() methods are used to implement the truncatechars_html and truncatewords_html template filters, which were thus vulnerable.
Github GHSA Github GHSA GHSA-2f9x-5v75-3qv4 Django Denial-of-service possibility in truncatechars_html and truncatewords_html template filters
Ubuntu USN Ubuntu USN USN-3591-1 Django vulnerabilities
History

No history.

Weaknesses

Sources

Status
PUBLISHED
Assigner
mitre
Published
Updated
Aug 5, 2024, 6:31 AM
Reserved
Feb 26, 2018, 12:00 AM
Status
Modified
Published
Mar 9, 2018, 8:29 PM
Modified
Jun 17, 2026, 2:03 AM
Severity
Moderate
Public date
Mar 6, 2018, 12:00 AM