CVE-2018-7536

MEDIUM

Django <2.0.3, <1.11.11, <1.8.19 - Info Disclosure

Title source: llm
STIX 2.1

Description

An issue was discovered in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19. The django.utils.html.urlize() function was extremely slow to evaluate certain inputs due to catastrophic backtracking vulnerabilities in two regular expressions (only one regular expression for Django 1.8.x). The urlize() function is used to implement the urlize and urlizetrunc template filters, which were thus vulnerable.

References (12)

Core 12
Core References
Third Party Advisory vendor-advisory
https://usn.ubuntu.com/3591-1/
Third Party Advisory vendor-advisory
https://access.redhat.com/errata/RHSA-2019:0051
Mailing List, Third Party Advisory mailing-list
https://lists.debian.org/debian-lts-announce/2018/03/msg00006.html
Third Party Advisory, VDB Entry vdb-entry
http://www.securityfocus.com/bid/103361
Third Party Advisory vendor-advisory
https://access.redhat.com/errata/RHSA-2019:0082
Third Party Advisory vendor-advisory
https://access.redhat.com/errata/RHSA-2018:2927
Third Party Advisory vendor-advisory
https://access.redhat.com/errata/RHSA-2019:0265
Third Party Advisory vendor-advisory
https://www.debian.org/security/2018/dsa-4161

Scores

CVSS v3 5.3
EPSS 0.0137
EPSS Percentile 80.5%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Details

CWE
CWE-185
Status published
Products (10)
canonical/ubuntu_linux 14.04
canonical/ubuntu_linux 16.04
canonical/ubuntu_linux 17.10
debian/debian_linux 7.0
debian/debian_linux 8.0
debian/debian_linux 9.0
djangoproject/django 1.8 - 1.8.19
pypi/Django 2.0a1 - 2.0.3PyPI
redhat/openstack 10
redhat/openstack 13
Published Mar 09, 2018
Tracked Since Feb 18, 2026