{"id":"CVE-2018-7537","published":"2018-03-09T20:00:00Z","modified":"2024-08-05T06:31:04Z","title":"An issue was discovered in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19","vendor":null,"product":null,"tier":"tail","description":{"text":"An issue was discovered in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19. If django.utils.text.Truncator's chars() and words() methods were passed the html=True argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking vulnerability in a regular expression. The chars() and words() methods are used to implement the truncatechars_html and truncatewords_html template filters, which were thus vulnerable.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.04374,"percentile":0.91265,"provenance":"source"},"cwes":[],"references":[{"url":"https://usn.ubuntu.com/3591-1/","tags":["vendor-advisory","x_refsource_UBUNTU"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/03/msg00006.html","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://www.djangoproject.com/weblog/2018/mar/06/security-releases/","tags":["x_refsource_CONFIRM"]},{"url":"https://access.redhat.com/errata/RHSA-2018:2927","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://www.securityfocus.com/bid/103357","tags":["vdb-entry","x_refsource_BID"]},{"url":"https://access.redhat.com/errata/RHSA-2019:0265","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://www.debian.org/security/2018/dsa-4161","tags":["vendor-advisory","x_refsource_DEBIAN"]}],"priority":{"score":18.3,"factors":[{"name":"EPSS percentile","points":18.25}]},"affected":[{"ecosystem":"PyPI","package":"Django","vulnerableRanges":[">=2.0, <2.0.3",">=1.11, <1.11.11",">=1.8, <1.8.19"],"patched":["2.0.3","1.11.11","1.8.19"],"from":["GHSA-2f9x-5v75-3qv4","PYSEC-2018-6"],"provenance":"source"}],"euvd":{"id":"EUVD-2018-0041","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-django-cve-2018-7537","children":[{"from":"CVE-2018-7537","to":"CVE-2024-27351","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["django/utils/text.py"],"commits":["https://github.com/django/django/commit/94c5da1d17a6b0d378866c66b605102c19f7988c","https://github.com/django/django/commit/a91436360b79a6ff995c3e5018bcc666dfaf1539","https://github.com/django/django/commit/3394fc6132436eca89e997083bae9985fb7e761e","https://github.com/django/django/commit/3c9a2771cc80821e041b16eb36c1c37af5349d4a"],"basis":"shared function","functions":["capfirst"]},{"kind":"similar","provenance":"machine","score":0.52,"basis":"same package + description similarity"}]}],"packageHistory":[{"cve":"CVE-2017-7233","published":"2017-04-04","fixed":"1.10.7","kev":false,"link":{"from":"CVE-2017-7233","to":"CVE-2018-7537","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:Django","fromFixed":"1.8.18","toFixed":"1.8.19","daysApart":339}]}},{"cve":"CVE-2017-12794","published":"2017-09-07","fixed":"1.11.5","kev":false},{"cve":"CVE-2018-6188","published":"2018-02-05","fixed":"2.0.2","kev":false,"link":{"from":"CVE-2018-6188","to":"CVE-2018-7537","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:Django","fromFixed":"1.11.10","toFixed":"1.11.11","daysApart":32},{"kind":"version-step","provenance":"source","package":"PyPI:Django","fromFixed":"2.0.2","toFixed":"2.0.3","daysApart":32}]}},{"cve":"CVE-2018-7536","published":"2018-03-09","fixed":"2.0.3","kev":false},{"cve":"CVE-2018-7537","published":"2018-03-09","fixed":"2.0.3","kev":false},{"cve":"CVE-2018-14574","published":"2018-08-03","fixed":"2.0.8","kev":false},{"cve":"CVE-2018-16984","published":"2018-10-02","fixed":"2.1.2","kev":false},{"cve":"CVE-2019-3498","published":"2019-01-09","fixed":"2.1.5","kev":false}],"package":"PyPI:Django"}}