CVE-2018-7537
- State
- Published
- Severity
- Not scored
- Published
- Mar 9, 2018
- Updated
- Aug 5, 2024
- Reserved
- Feb 26, 2018
Description
An issue was discovered in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19. If django.utils.text.Truncator's chars() and words() methods were passed the html=True argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking vulnerability in a regular expression. The chars() and words() methods are used to implement the truncatechars_html and truncatewords_html template filters, which were thus vulnerable.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- USN-3591-1vendor-advisory
- [debian-lts-announce] 20180308 [SECURITY] [DLA 1303-1] python-django security updatemailing-list
- https://www.djangoproject.com/weblog/2018/mar/06/security-releases/
- RHSA-2018:2927vendor-advisory
- 103357vdb-entry
- RHSA-2019:0265vendor-advisory
- DSA-4161vendor-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.