CVE-2018-7536 Django denial-of-service possibility in urlize and urlizetrunc template filters
Attackers can cause denial of service in Django applications by submitting inputs that trigger catastrophic backtracking in the urlize template filter.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-7536?
CVE-2018-7536 is a medium-severity denial of service vulnerability in Canonical Ubuntu Linux, published on 9 Mar 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19. The django.utils.html.urlize() function was extremely slow to evaluate certain inputs due to catastrophic backtracking vulnerabilities in two regular expressions (only one regular expression for Django 1.8.x). The urlize() function is used to implement the urlize and urlizetrunc template filters, which were thus vulnerable.
Weakness: CWE-185
Which versions are affected by CVE-2018-7536?
7 open source packages ship an affected version, including django and Django. It affects 4 products.
| Package | Affected | Fixed in |
|---|---|---|
django PyPI | From 1.11a1 | 1.11.11 |
django PyPI | From 1.8 | 1.8.19, 1.11.11, 2.0.3 |
django PyPI | From 1.8a1 | 1.8.19 |
django PyPI | From 2.0a1 | 2.0.3 |
Django PyPI | From 1.11a1 | 1.11.11 |
Django PyPI | From 1.8a1 | 1.8.19 |
1 more packages
Django PyPI | From 2.0a1 | 2.0.3 |
Linux distribution packages (5)
python-django Red Hat:openstack:10::el7 | All versions | 0:1.8.19-1.el7ost |
python-django-bash-completion Red Hat:openstack:10::el7 | All versions | 0:1.8.19-1.el7ost |
python-django Red Hat:openstack:13::el7 | All versions | 0:1.11.11-1.el7ost |
python-django-bash-completion Red Hat:openstack:13::el7 | All versions | 0:1.11.11-1.el7ost |
python2-django Red Hat:openstack:13::el7 | All versions | 0:1.11.11-1.el7ost |
Products include Canonical Ubuntu Linux, Debian Debian Linux, Djangoproject Django, Redhat Openstack.
How do I fix CVE-2018-7536?
Upgrade django to a fixed version for your release line: 1.11.11, 1.8.19 or 2.0.3.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2018-7536 being exploited?
There is no known exploitation of CVE-2018-7536 in the wild and no public exploit code.
Other vulnerabilities in Canonical Ubuntu Linux
Sources
Also known as ALPINE-CVE-2018-7536, DEBIAN-CVE-2018-7536, GHSA-r28v-mw67-m5p9, PYSEC-2018-5, RHSA-2019:0051, RHSA-2019:0082 and 1 more.