---

CVE-2018-7537 - log back

CVE-2018-7537 created at 25 Sep 2019 19:31:40
Severity	+ Medium
Remote	+ Remote
Type	+ Denial of service
Description	+ If django.utils.text.Truncator’s chars() and words() methods were passed the html=True argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking vulnerability in a regular expression. The chars() and words() methods are used to implement the truncatechars_html and truncatewords_html template filters, which were thus vulnerable.
References	+ https://docs.djangoproject.com/en/dev/releases/1.11.11/ + https://github.com/django/django/commit/97b7dd59bb8d6163239061e2022153c3415d146d
Notes