Skip to content

Django Denial-of-service possibility in truncatechars_html and truncatewords_html template filters

Moderate severity GitHub Reviewed Published Jan 4, 2019 to the GitHub Advisory Database • Updated Sep 17, 2024

Package

pip django (pip)

Affected versions

>= 2.0, < 2.0.3
>= 1.11, < 1.11.11
>= 1.8, < 1.8.19

Patched versions

2.0.3
1.11.11
1.8.19

Description

An issue was discovered in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19. If django.utils.text.Truncator's chars() and words() methods were passed the html=True argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking vulnerability in a regular expression. The chars() and words() methods are used to implement the truncatechars_html and truncatewords_html template filters, which were thus vulnerable.

References

Published to the GitHub Advisory Database Jan 4, 2019
Reviewed Jun 16, 2020
Last updated Sep 17, 2024

Severity

Moderate

EPSS score

0.955%
(84th percentile)

Weaknesses

CVE ID

CVE-2018-7537

GHSA ID

GHSA-2f9x-5v75-3qv4

Source code

Credits

Loading Checking history
See something to contribute? Suggest improvements for this vulnerability.