VDB
CVE-2018-7537
CVE-2018-7537
PUBLISHED
CVSS 5.300000190734863 MEDIUM
An issue was discovered in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19. If django.utils.text.Truncator's chars() and words() methods were passed the html=True argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking vulnerability in a regular expression. The chars() and words() methods are used to implement the truncatechars_html and truncatewords_html template filters, which were thus vulnerable.
EPSS 4.37% · 90.9th percentile
Risk Scores
CVSS 3.0
5.300000190734863
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
EPSS Score
4.37%
90.9th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ubuntu:16.04:LTS | python-django | 0, 1.7.9-1ubuntu5, 1.8.5-2ubuntu1 |
| Ubuntu:14.04:LTS | python-django | 1.6.1-2ubuntu0.10, 1.6.1-2ubuntu0.11, 1.6.1-2ubuntu0.12 |
Timeline
- Mar 6, 2018 CVE Published
- Apr 14, 2021 EPSS Score
- Feb 4, 2022 EPSS Score
- Mar 17, 2025 EPSS Score
- Mar 20, 2025 EPSS Score
- Mar 21, 2025 EPSS Score
- Mar 29, 2025 EPSS Score
- Apr 1, 2025 EPSS Score
- Apr 2, 2025 EPSS Score
- Apr 12, 2025 EPSS Score
- Apr 13, 2025 EPSS Score
- May 4, 2025 EPSS Score
References
- https://ubuntu.com/security/CVE-2018-7537 third-party-advisory
- https://www.djangoproject.com/weblog/2018/mar/06/security-releases/ third-party-advisory
- https://ubuntu.com/security/notices/USN-3591-1 vendor-advisory
- https://www.cve.org/CVERecord?id=CVE-2018-7537 third-party-advisory