GHSA-c4qh-4vgv-qc6g Django Denial-of-service in django.utils.text.Truncator

• PyPI Django: >= 1.11a1, < 1.11.23 → fixed in 1.11.23 • PyPI Django: >= 2.1a1, < 2.1.11 → fixed in 2.1.11 • PyPI Django: >= 2.2a1, < 2.2.4 → fixed in 2.2.4

An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. If `django.utils.text.Truncator`'s `chars()` and `words()` methods were passed the `html=True` argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking vulnerability in a regular expression. The `chars()` and `words()` methods are used to implement the `truncatechars_htm`l and `truncatewords_html` template filters, which were thus vulnerable.