CVE-2018-7536 log
| Source |
|
| Severity | Medium |
| Remote | Yes |
| Type | Denial of service |
| Description | The django.utils.html.urlize() function was extremely slow to evaluate certain inputs due to catastrophic backtracking vulnerabilities in two regular expressions. The urlize() function is used to implement the urlize and urlizetrunc template filters, which were thus vulnerable. The problematic regular expressions are replaced with parsing logic that behaves similarly. |
| Group | Package | Affected | Fixed | Severity | Status | Ticket |
|---|---|---|---|---|---|---|
| AVG-649 | python-django, python2-django | 1.11.10-1 | 1.11.11-1 | Medium | Fixed |
| Date | Advisory | Group | Package | Severity | Type |
|---|---|---|---|---|---|
| 06 Mar 2018 | ASA-201803-6 | AVG-649 | python2-django | Medium | denial of service |
| 06 Mar 2018 | ASA-201803-5 | AVG-649 | python-django | Medium | denial of service |
| References |
|---|
https://docs.djangoproject.com/en/dev/releases/1.11.11/ https://github.com/django/django/commit/8618271caa0b09daba39ff3b46567d33ae1e1d3a |