CVE-2018-7537: Medium severity Canonical Ubuntu Linux vulnerability
An issue was discovered in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19. If django.utils.text.Truncator's chars() and words() methods were passed the html=True argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking vulnerability in a regular expression. The chars() and words() methods are used to implement the truncatecharshtml and truncatewordshtml template filters, which were thus vulnerable.
Other sources
CVE-2018-7537: Denial-of-service possibility in truncatecharshtml and truncatewordshtml template filters ============================================================================
If django.utils.text.Truncator's chars() and words() methods were passed the html=True argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking vulnerability in a regular expression. The chars() and words() methods are used to implement the truncatecharshtml and truncatewordshtml template filters, which were thus vulnerable.
The backtracking problem in the regular expression is fixed.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/Djangoto a version that resolves this vulnerability.Fixed in 2.0.3 - Upgrade
Upgrade
redhat/Djangoto a version that resolves this vulnerability.Fixed in 1.11.11 - Upgrade
Upgrade
redhat/Djangoto a version that resolves this vulnerability.Fixed in 1.8.19 - Upgrade
Upgrade
pip/djangoto a version that resolves this vulnerability.Fixed in 1.8.19 - Upgrade
Upgrade
pip/djangoto a version that resolves this vulnerability.Fixed in 1.11.11 - Upgrade
Upgrade
pip/djangoto a version that resolves this vulnerability.Fixed in 2.0.3 - Upgrade
Upgrade
debian/python-djangoto a version that resolves this vulnerability.Fixed in 2:2.2.28-1~deb11u2Fixed in 2:2.2.28-1~deb11u12Fixed in 3:3.2.19-1+deb12u1Fixed in 3:3.2.25-0+deb12u1Fixed in 3:4.2.23-1Fixed in 3:4.2.27-0+deb13u1Fixed in 3:4.2.28-1 - Upgrade
Upgrade
Djangoto a version that resolves this vulnerability.Fixed in 2.0.3 - Upgrade
Upgrade
Djangoto a version that resolves this vulnerability.Fixed in 1.11.11 - Upgrade
Upgrade
Djangoto a version that resolves this vulnerability.Fixed in 1.8.19
Event History
Frequently Asked Questions
What is CVE-2018-7537?
CVE-2018-7537 is a vulnerability in Django versions 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19.
How severe is CVE-2018-7537?
CVE-2018-7537 has a severity rating of 5.3 (Medium).
How do I fix the CVE-2018-7537 vulnerability?
To fix the CVE-2018-7537 vulnerability, upgrade your Django installation to version 2.0.3, 1.11.11, or 1.8.19.
Where can I find more information about CVE-2018-7537?
More information about CVE-2018-7537 can be found on the MITRE website (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7537) and the Django website (https://www.djangoproject.com/weblog/2018/mar/06/security-releases/).
Is there a fix available for CVE-2018-7537?
Yes, there is a fix available for CVE-2018-7537. Upgrade your Django installation to version 2.0.3, 1.11.11, or 1.8.19.