Vulnetix
Try Vulnetix Request Demo
CVE-2018-7537 PUBLISHED

An issue was discovered in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19. If django.utils.text.Truncator's chars() and words() methods were passed the html=True argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking vulnerability in a regular expression. The chars() and words() methods are used to implement the truncatechars_html and truncatewords_html template filters, which were thus vulnerable.

EPSS 2.06% · 83.8th percentile

Risk Scores

EPSS Score
2.06%
83.8th percentile

Affected Products

VendorProductVersions
Ubuntu:16.04:LTSpython-django0, 1.7.9-1ubuntu5, 1.8.5-2ubuntu1
Ubuntu:14.04:LTSpython-django1.6.1-2ubuntu0.9, 1.6.1-2ubuntu0.10, 1.6.1-2ubuntu0.11

Timeline

References

Open in Interactive Console →