CVEvulnerability
CVE-2018-7536
5.3 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2018-03-09
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 5.3 MEDIUM — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:N/I:N/A:P
- Weaknesses
- CWE-185
Description
An issue was discovered in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19. The django.utils.html.urlize() function was extremely slow to evaluate certain inputs due to catastrophic backtracking vulnerabilities in two regular expressions (only one regular expression for Django 1.8.x). The urlize() function is used to implement the urlize and urlizetrunc template filters, which were thus vulnerable.
Affected configurations
• canonical ubuntu linux 14.04
• canonical ubuntu linux 16.04
• canonical ubuntu linux 17.10
• djangoproject django (>= 1.8 < 1.8.19)
• djangoproject django (>= 1.11 < 1.11.11)
• djangoproject django (>= 2.0 < 2.0.3)
• debian debian linux 7.0
• debian debian linux 8.0
• debian debian linux 9.0
• redhat openstack 10
• redhat openstack 13
Related
Weakness · CWE (1)
- CWE-185 Incorrect Regular Expression weakness
References
- http://www.securityfocus.com/bid/103361 Third Party Advisory, VDB Entry
- https://access.redhat.com/errata/RHSA-2018:2927 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:0051 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:0082 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:0265 Third Party Advisory
- https://github.com/django/django/commit/1ca63a66ef3163149ad822701273e8a1844192c2 github.com
- https://github.com/django/django/commit/abf89d729f210c692a50e0ad3f75fb6bec6fae16 github.com
- https://github.com/django/django/commit/e157315da3ae7005fa0683ffc9751dbeca7306c8 github.com
- https://lists.debian.org/debian-lts-announce/2018/03/msg00006.html Mailing List, Third Party Advisory
- https://usn.ubuntu.com/3591-1/ Third Party Advisory
- https://www.debian.org/security/2018/dsa-4161 Third Party Advisory
- https://www.djangoproject.com/weblog/2018/mar/06/security-releases/ Release Notes, Vendor Advisory
- http://www.securityfocus.com/bid/103361 Third Party Advisory, VDB Entry
- https://access.redhat.com/errata/RHSA-2018:2927 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:0051 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:0082 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:0265 Third Party Advisory
- https://github.com/django/django/commit/1ca63a66ef3163149ad822701273e8a1844192c2 github.com
- https://github.com/django/django/commit/abf89d729f210c692a50e0ad3f75fb6bec6fae16 github.com
- https://github.com/django/django/commit/e157315da3ae7005fa0683ffc9751dbeca7306c8 github.com
- https://lists.debian.org/debian-lts-announce/2018/03/msg00006.html Mailing List, Third Party Advisory
- https://usn.ubuntu.com/3591-1/ Third Party Advisory
- https://www.debian.org/security/2018/dsa-4161 Third Party Advisory
- https://www.djangoproject.com/weblog/2018/mar/06/security-releases/ Release Notes, Vendor Advisory