Regular Expression Denial Of Service (ReDoS)

Django is vulnerable to regular expression denial of service attacks.The application takes more than linear time when certain strings are passed to the urlize function, resulting in an application crash...

Ubuntu 14.04 LTS / 16.04 LTS : Django vulnerabilities (USN-3591-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3591-1 advisory. James Davis discovered that Django incorrectly handled certain template filters. A remote attacker could possibly use this issue to cause...

CVE-2018-7537

An issue was discovered in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19. If django.utils.text.Truncator's chars and words methods were passed the html=True argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking vulnerability in a...

USN-3591-1: Django vulnerabilities

James Davis discovered that Django incorrectly handled certain template filters. A remote attacker could possibly use this issue to cause Django to consume resources, resulting in a denial of service...

USN-3591-1 python-django vulnerabilities

James Davis discovered that Django incorrectly handled certain template filters. A remote attacker could possibly use this issue to cause Django to consume resources, resulting in a denial of service...

CVE-2018-7537

An issue was discovered in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19. If django.utils.text.Truncator's chars and words methods were passed the html=True argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking vulnerability in a...

CVE-2018-7536

An issue was discovered in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19. The django.utils.html.urlize function was extremely slow to evaluate certain inputs due to catastrophic backtracking vulnerabilities in two regular expressions only one regular expression for Django...

UBUNTU-CVE-2018-7536

An issue was discovered in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19. The django.utils.html.urlize function was extremely slow to evaluate certain inputs due to catastrophic backtracking vulnerabilities in two regular expressions only one regular expression for Django...

UBUNTU-CVE-2018-7537

An issue was discovered in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19. If django.utils.text.Truncator's chars and words methods were passed the html=True argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking vulnerability in a...

Information Exposure

Overview django is a Python Web framework. Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS attacks. The django.utils.html.urlize function was extremely slow to evaluate certain inputs due to catastrophic backtracking in two regular expressions. The...

Regular Expression Denial of Service (ReDoS)

Overview django is a Python Web framework. Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS attacks. If django.utils.text.Truncator's chars and words methods were passed the html=True argument, they were extremely slow to evaluate certain inputs due t...

[ASA-201803-5] python-django: denial of service

Arch Linux Security Advisory ASA-201803-5 ========================================= Severity: Medium Date : 2018-03-06 CVE-ID : CVE-2018-7536 CVE-2018-7537 Package : python-django Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-649 Summary ======= The package...

PT-2018-1903

Name of the Vulnerable Software and Affected Versions Django versions 2.0 before 2.0.3 Django versions 1.11 before 1.11.11 Django versions 1.8 before 1.8.19 Description The issue is related to a catastrophic backtracking vulnerability in a regular expression used by the django.utils.text.Truncato...

PT-2018-18141

Name of the Vulnerable Software and Affected Versions Django versions 2.0 through 2.0.2 Django versions 1.11 through 1.11.10 Django versions 1.8 through 1.8.18 Description An issue was discovered in the django.utils.html.urlize function, which was extremely slow to evaluate certain inputs due to...

[ASA-201803-6] python2-django: denial of service

Arch Linux Security Advisory ASA-201803-6 ========================================= Severity: Medium Date : 2018-03-06 CVE-ID : CVE-2018-7536 CVE-2018-7537 Package : python2-django Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-649 Summary ======= The package...

Regular Expression Denial of Service (ReDoS)

Overview django-cacheops is an app that supports automatic or manual queryset caching and automatic granular event-driven invalidation. Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS attacks. This can cause an impact of about 10 seconds matching tim...

Fedora Update for python-django FEDORA-2018-2c612c6d92

The remote host is missing an update for the SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora 27 : python-django (2018-2c612c6d92)

update to 1.11.10, fix for CVE-2018-6188: Information leakage in AuthenticationForm Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible witho...

Ubuntu 17.10 : python-django vulnerabilities (USN-3559-1)

It was discovered that Django incorrectly handled certain requests. An attacker could possibly use this to access sensitive information. CVE-2017-12794, CVE-2018-6188. Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory...

Debian DSA-4107-1 : django-anymail - security update

It was discovered that the webhook validation of Anymail, a Django email backends for multiple ESPs, is prone to a timing attack. A remote attacker can take advantage of this flaw to obtain a WEBHOOKAUTHORIZATION secret and post arbitrary email tracking events. C Tenable Network Security, Inc. Th...