CVE-2018-7536: Medium severity Canonical Ubuntu Linux vulnerability
An issue was discovered in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19. The django.utils.html.urlize() function was extremely slow to evaluate certain inputs due to catastrophic backtracking vulnerabilities in two regular expressions (only one regular expression for Django 1.8.x). The urlize() function is used to implement the urlize and urlizetrunc template filters, which were thus vulnerable.
Other sources
An issue was discovered in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19. The django.utils.html.urlize() function was extremely slow to evaluate certain inputs due to catastrophic backtracking vulnerabilities in two regular expressions (only one regular expression for Django 1.8.x). The urlize() function is used to implement the urlize and urlizetrunc template filters, which were thus vulnerable.
— Launchpad
CVE-2018-7536: Denial-of-service possibility in urlize and urlizetrunc template filters ===========================================================================
The django.utils.html.urlize() function was extremely slow to evaluate certain inputs due to catastrophic backtracking vulnerabilities in two regular expressions (one regular expression for Django 1.8). The urlize() function is used to implement the urlize and urlizetrunc template filters, which were thus vulnerable.
The problematic regular expressions are replaced with parsing logic that behaves similarly.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/Djangoto a version that resolves this vulnerability.Fixed in 2.0.3 - Upgrade
Upgrade
redhat/Djangoto a version that resolves this vulnerability.Fixed in 1.11.11 - Upgrade
Upgrade
redhat/Djangoto a version that resolves this vulnerability.Fixed in 1.8.19 - Upgrade
Upgrade
pip/Djangoto a version that resolves this vulnerability.Fixed in 1.8.19 - Upgrade
Upgrade
pip/Djangoto a version that resolves this vulnerability.Fixed in 1.11.11 - Upgrade
Upgrade
pip/Djangoto a version that resolves this vulnerability.Fixed in 2.0.3 - Upgrade
Upgrade
debian/python-djangoto a version that resolves this vulnerability.Fixed in 2:2.2.28-1~deb11u2Fixed in 2:2.2.28-1~deb11u12Fixed in 3:3.2.19-1+deb12u1Fixed in 3:3.2.25-0+deb12u1Fixed in 3:4.2.23-1Fixed in 3:4.2.27-0+deb13u1Fixed in 3:4.2.28-1 - Upgrade
Upgrade
Djangoto a version that resolves this vulnerability.Fixed in 2.0.3 - Upgrade
Upgrade
Djangoto a version that resolves this vulnerability.Fixed in 1.11.11 - Upgrade
Upgrade
Djangoto a version that resolves this vulnerability.Fixed in 1.8.19
Event History
Frequently Asked Questions
What is CVE-2018-7536?
CVE-2018-7536 is a vulnerability in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19 that allows for catastrophic backtracking and can result in a denial of service attack.
How severe is CVE-2018-7536?
CVE-2018-7536 has a severity rating of 5.3, which is considered medium.
How can I fix CVE-2018-7536?
To fix CVE-2018-7536, upgrade to Django 1.8.19, 1.11.11, or 2.0.3 depending on the version you are using.
Where can I find more information about CVE-2018-7536?
You can find more information about CVE-2018-7536 on the CVE Mitre website and the Django security releases page.
What is the common weakness enumeration (CWE) for CVE-2018-7536?
The CWE for CVE-2018-7536 is CWE-185, which refers to a behavior that can expose sensitive information.