Catastrophic Backtracking Vulnerability in Django
Summary
CVE-2018-7536: An issue was discovered in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19. Affects py-django across 4 version ranges.
< 1.11.11-r0
< 1ca63a66ef3163149ad822701273e8a1844192c2
< abf89d729f210c692a50e0ad3f75fb6bec6fae16
< e157315da3ae7005fa0683ffc9751dbeca7306c8
Fixed in 1.11.11-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Django is a popular web framework written in Python that allows developers to build web applications quickly and efficiently. It provides a wide range of features and tools for handling various aspects of web development. However, a vulnerability has been discovered in Django versions 1.8 to 2.0.3, which can lead to a significant performance degradation and potential security risks.
Vulnerability Detail
The vulnerability, identified as CVE-2018-7536, is caused by two regular expressions used in the django.utils.html.urlize() function. These regular expressions exhibit catastrophic backtracking behavior, resulting in extremely slow evaluation for certain inputs. This vulnerability affects the urlize and urlizetrunc template filters, which are commonly used in Django applications. An attacker could exploit this vulnerability to cause denial of service or potentially execute arbitrary code.
How To Fix
Minimum fixed version
1.11.11-r0
This is the first release that contains the fix.
sudo apk add --upgrade py-djangoTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading Django is not immediately feasible, a temporary workaround can be implemented by modifying the affected code. The urlize and urlizetrunc template filters should be replaced with custom filters that do not rely on the vulnerable urlize() function. Here is an example of a custom filter that can be used as a workaround:
from django import template
from django.utils.html import urlize
register = template.Library()
@register.filter
def custom_urlize(value):
return urlize(value, nofollow=True)
By using this custom filter instead of the vulnerable template filters, the application can mitigate the risk of the vulnerability.
Conclusion
The catastrophic backtracking vulnerability in Django versions 1.8 to 2.0.3 can have severe performance implications and potential security risks. It is crucial for developers to upgrade their Django installations to fixed versions or implement the provided workaround to mitigate the vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for py-django →
FAQ
Django is a high-level Python web framework that enables developers to build web applications quickly and efficiently. It provides a wide range of tools and features for handling various aspects of web development.
The vulnerability affects Django versions 1.8 to 2.0.3. If you are using any of these versions, it is recommended to upgrade to a fixed version as soon as possible.
Catastrophic backtracking is a behavior exhibited by certain regular expressions when faced with specific inputs. It can cause the regular expression evaluation to take an extremely long time, leading to performance degradation and potential security risks.
The vulnerability can result in a significant performance degradation for Django applications. In some cases, it may also allow attackers to cause denial of service or execute arbitrary code, depending on the specific context in which the vulnerable code is used.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert uses a manifest file like package-lock.json to monitor and alert in real-time for open-source vulnerabilities in the software.
Related vulnerabilities
Recent vulnerabilities recorded for py-django.
