Catastrophic Backtracking Vulnerability in Django
Summary
CVE-2018-7537: An issue was discovered in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19. Affects py-django across 2 version ranges.
< 1.11.11-r0
>= feac4c30ce7635e17ce1adc4c2c7a1eb0721aeb3, < c686dd8e6bb3817bcf04b8f13c025b4d3c3dc6dc
Fixed in 1.11.11-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Django is a popular web framework written in Python that simplifies the development of web applications. It provides various utilities and features to handle common web development tasks. However, Django versions 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19 are vulnerable to a catastrophic backtracking vulnerability in the Truncator's chars() and words() methods when the html=True argument is used. This vulnerability affects the truncatechars_html and truncatewords_html template filters.
Vulnerability Detail
The vulnerability arises due to a regular expression used in the Truncator's chars() and words() methods. When the html=True argument is passed, certain inputs can cause the regular expression to exhibit catastrophic backtracking, resulting in extremely slow evaluation. This can be exploited by an attacker to perform denial-of-service attacks against Django applications that utilize the affected template filters. The vulnerability has a CVSS score of 5.3.
How To Fix
Minimum fixed version
1.11.11-r0
This is the first release that contains the fix.
sudo apk add --upgrade py-djangoTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading Django is not immediately feasible, a workaround can be implemented by avoiding the usage of the truncatechars_html and truncatewords_html template filters. Instead, developers can manually truncate the text in their views or templates using alternative methods that do not rely on the vulnerable filters.
Conclusion
In conclusion, Django versions 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19 are vulnerable to a catastrophic backtracking vulnerability in the Truncator's chars() and words() methods. Upgrading to the patched versions or avoiding the usage of the vulnerable template filters is recommended to mitigate the risk. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for py-django →
FAQ
Django is a web framework written in Python that simplifies web application development.
Django versions 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19 are affected.
A catastrophic backtracking vulnerability occurs when a regular expression takes an exponentially long time to evaluate certain inputs, leading to a denial-of-service risk.
An attacker can exploit this vulnerability by providing specially crafted inputs to Django applications that use the truncatechars_html or truncatewords_html template filters, causing the application to become unresponsive.
The CVSS score of this vulnerability is 5.3, indicating a moderate severity level.
Related vulnerabilities
Recent vulnerabilities recorded for py-django.
