vulnwire
5.3med

CVE-2018-7537

Django Denial-of-service possibility in truncatechars_html and truncatewords_html template filters

Also known as GHSA-2f9x-5v75-3qv4, PYSEC-2018-6

Published 8 y ago · modified 4 mo ago · JSON

CVSS
5.3
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
4.4%
percentile 91%
Public exploits
0
none known

An issue was discovered in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19. If django.utils.text.Truncator's chars() and words() methods were passed the html=True argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking vulnerability in a regular expression. The chars() and words() methods are used to implement the truncatechars_html and truncatewords_html template filters, which were thus vulnerable.

Exploit prediction (EPSS)

4.37% probability of exploitation in the next 30 days, higher than 91% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.05.3CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
NVD2.05.0AV:N/AC:L/Au:N/C:N/I:N/A:P
GitHub3.05.3CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Affected packages

EcosystemPackageAffectedFixed in
pypidjango
>=2.0, <2.0.3
>=1.11, <1.11.11
>=1.8, <1.8.19
2.0.3
1.11.11
1.8.19

Classification

Weakness
  • CWE-185 Incorrect Regular Expression
Technology feeds
Django (RSS, critical only)

References

  • usn.ubuntu.com /3591-1/ · vendor-advisory, x_refsource_UBUNTU, x_transferred
  • lists.debian.org /debian-lts-announce/2018/03/msg00006.html · mailing-list, x_refsource_MLIST, x_transferred
  • djangoproject.com /weblog/2018/mar/06/security-releases/ · x_refsource_CONFIRM, x_transferred
  • access.redhat.com /errata/RHSA-2018:2927 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • securityfocus.com /bid/103357 · vdb-entry, x_refsource_BID, x_transferred
  • access.redhat.com /errata/RHSA-2019:0265 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • debian.org /security/2018/dsa-4161 · vendor-advisory, x_refsource_DEBIAN, x_transferred
  • nvd.nist.gov /vuln/detail/CVE-2018-7537 · advisory
  • github.com /django/django/commit/94c5da1d17a6b0d378866c66b605102c19f7988c · web
  • github.com /django/django/commit/a91436360b79a6ff995c3e5018bcc666dfaf1539 · web
  • github.com /django/django/commit/d17974a287a6ea2e361daff88fcc004cbd6835fa · web
  • github.com /advisories/GHSA-2f9x-5v75-3qv4 · advisory
  • github.com /django/django · package
  • github.com /pypa/advisory-database/tree/main/vulns/django/PYSEC-2018-6.yaml · web
  • usn.ubuntu.com /3591-1 · web
  • djangoproject.com /weblog/2018/mar/06/security-releases · web

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.