Resource exhaustion in Django - CVE-2018-7537

Vulnerability identifier: #VU11476

CSH Severity: Low

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-7537

CWE-ID: CWE-400

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The weakness exists in the django.utils.html.urlize() function due to it was extremely slow to evaluate certain inputs due to catastrophic backtracking vulnerabilities in two regular expressions. The urlize() function is used to implement the urlize and urlizetrunc template filters, which were thus vulnerable. A remote attacker can cause the service to crash.

Django
Arch Linux
Debian Linux
Fedora
py-django (Alpine package)
python-django16
Django
python-django
python2-django1.11
Red Hat Gluster Storage Server for On-premise

Update to versions 2.0.3, 1.11.11 or 1.8.19.

py-django (Alpine package) - update to 1.8.19-r0
python-django16 - addressed in versions 1.6.11.7-1.el7, 1.6.11.7-5.el7
Django - update to 1.6-20180409143454.c7b355af
python-django - addressed in versions 1.11.11-1.fc27, 1.11.13-2.el7, 1.11.13-4.el7, 2.0.3-1.fc28
python2-django1.11 - update to 1.11.11-1.fc28

• https://www.djangoproject.com/weblog/2018/mar/06/security-releases/

• Arch Linux update for python-django
• Arch Linux update for python2-django
• Debian update for python-django
• Red Hat update for Red Hat Gluster Storage Web Administration
• Resource exhaustion in py-django (Alpine package)
• Fedora 27 update for python-django
• Fedora 28 update for python-django
• Fedora EPEL 7 update for python-django16
• Fedora 28 Modular update for django
• Fedora 28 update for python2-django1.11
• Fedora EPEL 7 update for python-django
• Fedora EPEL 7 update for python-django, python-django16