An issue was discovered in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before…
Priority LOW 31CWE-185Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · Low
- Fix status
- Partial Red Hat: 6 fixed, 14 without a fix
Attack profile from CVSS 3.0 · NVD. Fix status from CNA, GitHub and Red Hat.
Summary
An issue was discovered in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19. The django.utils.html.urlize() function was extremely slow to evaluate certain inputs due to catastrophic backtracking vulnerabilities in two regular expressions (only one regular expression for Django 1.8.x). The urlize() function is used to implement the urlize and urlizetrunc template filters, which were thus vulnerable.
Why it matters now
EPSS 0.04554 91st percentileScored 2026-11-07
Fix Partial Django (PyPI): 2.0.3, 1.11.11, 1.8.19Red Hat: 4 advisoriesRed Hat: 6 fixed, 14 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | Django (PyPI) | 2.0a1 to before 2.0.3 | 2.0.3 | Patch available | GHSA-r28v-mw67-m5p9 |
| — | Django (PyPI) | 1.11a1 to before 1.11.11 | 1.11.11 | Patch available | GHSA-r28v-mw67-m5p9 |
| — | Django (PyPI) | 1.8a1 to before 1.8.19 | 1.8.19 | Patch available | GHSA-r28v-mw67-m5p9 |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- Django (PyPI) Vendor— Affected 2.0a1 to before 2.0.3 Fixed in 2.0.3 Patch available GHSA-r28v-mw67-m5p9
- Django (PyPI) Vendor— Affected 1.11a1 to before 1.11.11 Fixed in 1.11.11 Patch available GHSA-r28v-mw67-m5p9
- Django (PyPI) Vendor— Affected 1.8a1 to before 1.8.19 Fixed in 1.8.19 Patch available GHSA-r28v-mw67-m5p9
CPE configurations NVD · 9
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:* | 14.04 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:* | 16.04 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:17.10:*:*:*:*:*:*:* | 17.10 | Vulnerable | Canonical |
| cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:* | 1.8 to before 1.8.19; 1.11 to before 1.11.11; 2.0 to before 2.0.3 | Vulnerable | djangoproject |
| cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:* | 7.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* | 8.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Debian |
| cpe:2.3:a:redhat:openstack:10:*:*:*:*:*:*:* | 10 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:openstack:13:*:*:*:*:*:*:* | 13 | Vulnerable | Red Hat |
- cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:* Versions 14.04 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:* Versions 16.04 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:17.10:*:*:*:*:*:*:* Versions 17.10 Vulnerable ·Canonical
- cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:* Versions 1.8 to before 1.8.19; 1.11 to before 1.11.11; 2.0 to before 2.0.3 Vulnerable ·djangoproject
- cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
- cpe:2.3:a:redhat:openstack:10:*:*:*:*:*:*:* Versions 10 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:openstack:13:*:*:*:*:*:*:* Versions 13 Vulnerable ·Red Hat
Remediation
- Fix · GHSA-r28v-mw67-m5p9 Django (PyPI) Fixed in 2.0.3 Advisory →
- Fix · GHSA-r28v-mw67-m5p9 Django (PyPI) Fixed in 1.11.11 Advisory →
- Fix · GHSA-r28v-mw67-m5p9 Django (PyPI) Fixed in 1.8.19 Advisory →
Red Hat 4 advisories
- RHSA-2019:0265 Released 2019-02-04 · Red Hat rating ModerateRed Hat Gluster Storage Web Administration security update
- Red Hat Gluster 3.4 Web Administration Node Agent on RHEL-7 tendrl-collectd-selinux-1.5.4-3.el7rhgs, tendrl-commons-1.6.3-15.el7rhgs, tendrl-node-agent-1.6.3-15.el7rhgs +1
- Red Hat Gluster 3.4 Web Administration on RHEL-7 carbon-selinux-1.5.4-3.el7rhgs, graphite-web-1.1.4-1.el7rhgs, python-cachetools-1.0.3-1.1.el7rhgs +17
- RHSA-2019:0082 Released 2019-01-16 · Red Hat rating Moderatepython-django security update
- Red Hat OpenStack Platform 13.0 python-django-1.11.11-1.el7ost, python-django-bash-completion-1.11.11-1.el7ost, python2-django-1.11.11-1.el7ost
- RHSA-2019:0051 Released 2019-01-16 · Red Hat rating Moderatepython-django security update
- Red Hat OpenStack Platform 10.0 python-django-1.8.19-1.el7ost, python-django-bash-completion-1.8.19-1.el7ost
Show 1 more Red Hat advisories
- RHSA-2018:2927 Released 2018-10-16 · Red Hat rating ImportantSatellite 6.4 security, bug fix, and enhancement update
- Red Hat Satellite 6.4 SOAPpy-0.11.6-17.el7, ansiblerole-insights-client-1.5-1.el7sat, candlepin-2.4.8-1.el7 +47
- Red Hat Satellite Capsule 6.4 SOAPpy-0.11.6-17.el7, ansiblerole-insights-client-1.5-1.el7sat, createrepo_c-0.7.4-1.el7sat +47
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Ceph Storage 1.3 | Affected | No fix planned: Will not fix |
| Red Hat Ceph Storage 2 | Affected | No fix planned: Will not fix |
| Red Hat Ceph Storage 3 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux OpenStack Platform 6 (Juno) | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux OpenStack Platform 7 (Kilo) | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux OpenStack Platform 7 (Kilo) Operational Tools | Affected | No fix planned: Will not fix |
| Red Hat OpenStack Platform 11 (Ocata) | Affected | No fix planned: Will not fix |
| Red Hat OpenStack Platform 12 (Pike) | Affected | No fix yet |
| Red Hat OpenStack Platform 8 (Liberty) | Affected | No fix planned: Will not fix |
| Red Hat OpenStack Platform 8 (Liberty) Operational Tools | Affected | No fix planned: Will not fix |
| Red Hat OpenStack Platform 9 (Mitaka) | Affected | No fix planned: Will not fix |
| Red Hat OpenStack Platform 9 (Mitaka) Operational Tools | Affected | No fix planned: Will not fix |
| Red Hat Storage Console 2 | Affected | No fix planned: Will not fix |
| Red Hat Subscription Asset Manager | Affected | No fix planned: Will not fix |
| Red Hat Gluster 3.4 Web Administration Node Agent on RHEL-7 | Fixed | RHSA-2019:0265 |
| Red Hat Gluster 3.4 Web Administration on RHEL-7 | Fixed | RHSA-2019:0265 |
| Red Hat OpenStack Platform 10.0 | Fixed | RHSA-2019:0051 |
| Red Hat OpenStack Platform 13.0 | Fixed | RHSA-2019:0082 |
| Red Hat Satellite 6.4 | Fixed | RHSA-2018:2927 |
| Red Hat Satellite Capsule 6.4 | Fixed | RHSA-2018:2927 |
Timeline
- 2026-10-02 Threatist record created from CVE-2018-7536
- 2026-10-03 Alias added: GHSA-r28v-mw67-m5p9
References
Advisory 10
- USN-3591-1
- RHSA-2019:0051
- [debian-lts-announce] 20180308 [SECURITY] [DLA 1303-1] python-django security update
- https://www.djangoproject.com/weblog/2018/mar/06/security-releases/
- RHSA-2019:0082
- RHSA-2018:2927
- RHSA-2019:0265
- DSA-4161
- https://nvd.nist.gov/vuln/detail/CVE-2018-7536
- https://github.com/advisories/GHSA-r28v-mw67-m5p9
Other 8
- https://github.com/django/django/commit/1ca63a66ef3163149ad822701273e8a1844192c2
- https://github.com/django/django/commit/abf89d729f210c692a50e0ad3f75fb6bec6fae16
- https://github.com/django/django/commit/e157315da3ae7005fa0683ffc9751dbeca7306c8
- https://github.com/django/django
- https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2018-5.yaml
- https://usn.ubuntu.com/3591-1
- https://web.archive.org/web/20200227131019/http://www.securityfocus.com/bid/103361
- https://www.djangoproject.com/weblog/2018/mar/06/security-releases
Sources
- CVE-2018-7536 · CVE Program
- CVE-2018-7536 · NVD
- FIRST EPSS
- GHSA-r28v-mw67-m5p9 · GitHub Advisory Database · CC BY 4.0
- CVE-2018-7536 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences