CVE-2018-7537

Name of the Vulnerable Software and Affected Versions Django versions 2.0 before 2.0.3 Django versions 1.11 before 1.11.11 Django versions 1.8 before 1.8.19

Description The issue is related to a catastrophic backtracking vulnerability in a regular expression used by the django.utils.text.Truncator class, specifically in its chars() and words() methods when the html=True argument is passed. This vulnerability affects the truncatechars html and truncatewords html template filters. An attacker could exploit this by crafting a string that leads to a denial of service.

Recommendations For Django versions 2.0 before 2.0.3, update to version 2.0.3 or later. For Django versions 1.11 before 1.11.11, update to version 1.11.11 or later. For Django versions 1.8 before 1.8.19, update to version 1.8.19 or later. As a temporary workaround, consider avoiding the use of the html=True argument in the chars() and words() methods of django.utils.text.Truncator until a patch is applied.