Summary
James Davis discovered that Django incorrectly handled certain template
filters. A remote attacker could possibly use this issue to cause Django
to consume resources, resulting in a denial of service.
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 14.04 LTS 14.04:LTS | python-django | 1.6.11-0ubuntu1.2 |
| Ubuntu · 16.04 LTS 16.04:LTS | python-django | 1.8.7-1ubuntu5.6 |
Vulnerabilities 2
-
Medium 5.3
Django denial-of-service possibility in urlize and urlizetrunc template filters
An issue was discovered in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19. The django.utils.html.urlize() function was extremely slow to evaluate certain inputs due to catastrophic backtracking vulnerabilities in two regular expressions (…
-
Medium 5.3
Django Denial-of-service possibility in truncatechars_html and truncatewords_html template filters
An issue was discovered in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19. If django.utils.text.Truncator's chars() and words() methods were passed the html=True argument, they were extremely slow to evaluate certain inputs due to a catas…