Vulnerability Details CVE-2018-7537
An issue was discovered in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19. If django.utils.text.Truncator's chars() and words() methods were passed the html=True argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking vulnerability in a regular expression. The chars() and words() methods are used to implement the truncatechars_html and truncatewords_html template filters, which were thus vulnerable.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.012
EPSS Ranking 78.1%
CVSS Severity
CVSS v3 Score 5.3
CVSS v2 Score 5.0
Products affected by CVE-2018-7537
-
cpe:2.3:a:djangoproject:django:1.11
-
cpe:2.3:a:djangoproject:django:1.11.1
-
cpe:2.3:a:djangoproject:django:1.11.10
-
cpe:2.3:a:djangoproject:django:1.11.2
-
cpe:2.3:a:djangoproject:django:1.11.3
-
cpe:2.3:a:djangoproject:django:1.11.4
-
cpe:2.3:a:djangoproject:django:1.11.5
-
cpe:2.3:a:djangoproject:django:1.11.6
-
cpe:2.3:a:djangoproject:django:1.11.7
-
cpe:2.3:a:djangoproject:django:1.11.8
-
cpe:2.3:a:djangoproject:django:1.11.9
-
cpe:2.3:a:djangoproject:django:1.8
-
cpe:2.3:a:djangoproject:django:1.8.0
-
cpe:2.3:a:djangoproject:django:1.8.1
-
cpe:2.3:a:djangoproject:django:1.8.10
-
cpe:2.3:a:djangoproject:django:1.8.11
-
cpe:2.3:a:djangoproject:django:1.8.12
-
cpe:2.3:a:djangoproject:django:1.8.13
-
cpe:2.3:a:djangoproject:django:1.8.14
-
cpe:2.3:a:djangoproject:django:1.8.15
-
cpe:2.3:a:djangoproject:django:1.8.16
-
cpe:2.3:a:djangoproject:django:1.8.17
-
cpe:2.3:a:djangoproject:django:1.8.18
-
cpe:2.3:a:djangoproject:django:1.8.2
-
cpe:2.3:a:djangoproject:django:1.8.3
-
cpe:2.3:a:djangoproject:django:1.8.4
-
cpe:2.3:a:djangoproject:django:1.8.5
-
cpe:2.3:a:djangoproject:django:1.8.6
-
cpe:2.3:a:djangoproject:django:1.8.7
-
cpe:2.3:a:djangoproject:django:1.8.8
-
cpe:2.3:a:djangoproject:django:1.8.9
-
cpe:2.3:a:djangoproject:django:2.0
-
cpe:2.3:a:djangoproject:django:2.0.1
-
cpe:2.3:a:djangoproject:django:2.0.2
-
cpe:2.3:o:canonical:ubuntu_linux:14.04
-
cpe:2.3:o:canonical:ubuntu_linux:16.04
-
cpe:2.3:o:canonical:ubuntu_linux:17.10
-
cpe:2.3:o:debian:debian_linux:7.0
-
cpe:2.3:o:debian:debian_linux:8.0
-
cpe:2.3:o:debian:debian_linux:9.0