CVE-2018-7536 — Django denial-of-service possibility in urlize and urlizetrunc template filters

Description

An issue was discovered in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19. The django.utils.html.urlize() function was extremely slow to evaluate certain inputs due to catastrophic backtracking vulnerabilities in two regular expressions (only one regular expression for Django 1.8.x). The urlize() function is used to implement the urlize and urlizetrunc template filters, which were thus vulnerable.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	python-django	1:1.11.11-1	—
Debian 13	python-django	1:1.11.11-1	—
Debian 12	python-django	1:1.11.11-1	—
Debian 9	python-django	1:1.10.7-2+deb9u1	DSA-4161-1
Debian 8	python-django	1.7.11-1+deb8u3	DSA-4161-1

Show 1 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Debian 7	python-django	1.4.22-1+deb7u4	DLA-1303-1

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu 16.04 LTS	python-django	1.8.7-1ubuntu5.6	USN-3591-1
Ubuntu 14.04 LTS	python-django	1.6.11-0ubuntu1.2	USN-3591-1

Red Hat

Security tracker ↗

Release	Package	Fixed in	Advisory
Red Hat Satellite Capsule 6	SOAPpy	0.11.6-17.el7	RHSA-2018:2927
Red Hat Satellite Capsule 6	ansiblerole-insights-client	1.5-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	createrepo_c +1	0.7.4-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	foreman +1	1.18.0.37-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	foreman-bootloaders-redhat +1	201801241201-3.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	foreman-installer	1:1.18.0.2-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	foreman-proxy +1	1.18.0.1-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	gofer +2	2.12.1-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	hfsplus-tools	332.14-12.el7	RHSA-2018:2927
Red Hat Satellite Capsule 6	katello +3	3.7.0-8.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	katello-certs-tools	2.4.0-2.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	katello-client-bootstrap	1.6.0-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	katello-installer-base +1	3.7.0.10-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	katello-selinux	3.0.3-2.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	kobo	0.5.1-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	libstemmer	0-2.585svn.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	libwebsockets	2.1.0-3.el7	RHSA-2018:2927
Red Hat Satellite Capsule 6	livecd-tools +1	1:20.4-1.6.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	mod_passenger +3	4.0.18-24.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	mod_xsendfile	0.12-10.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	mongodb +1	2.6.11-2.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	ostree	2017.1-2.atomic.el7	RHSA-2018:2927
Red Hat Satellite Capsule 6	pulp +14	2.16.4.1-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	pulp-docker +3	3.1.4.1-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	pulp-katello	1.0.2-5.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	pulp-ostree +4	1.3.0-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	pulp-puppet +3	2.16.4-3.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	pulp-rpm +4	2.16.4.1-5.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	puppet-agent	5.5.0-2.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	puppet-agent-oauth	0.5.1-3.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	puppet-foreman_scap_client	0.3.16-3.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	puppetlabs-stdlib	4.2.1-1.20140510git08b00d9.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	puppetserver	5.3.1-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	python-amqp +1	2.2.2-3.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	python-anyjson	0.3.3-5.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	python-billiard +1	1:3.5.0.3-3.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	python-blinker	1.3-2.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	python-bson +2	3.2-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	python-celery +1	4.0.2-4.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	python-crane	3.1.1-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	python-django +1	1.11.11-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	python-flask	1:0.10.1-4.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	python-fpconst	0.7.3-12.el7	RHSA-2018:2927
Red Hat Satellite Capsule 6	python-gnupg	0.3.7-1.el7ui	RHSA-2018:2927
Red Hat Satellite Capsule 6	python-isodate	0.5.0-5.pulp.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	python-itsdangerous	0.23-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	python-jinja2	2.7.2-2.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	python-kid	0.9.6-11.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	python-kombu +1	1:4.0.2-8.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	python-mongoengine	0.10.5-2.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	python-nectar	1.5.6-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	python-oauth2	1.5.211-8.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	python-okaara	1.0.32-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	python-qpid	1.35.0-5.el7	RHSA-2018:2927
Red Hat Satellite Capsule 6	python-semantic_version	2.2.0-6.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	python-simplejson	3.2.0-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	python-twisted-core	12.2.0-4.el7	RHSA-2018:2927
Red Hat Satellite Capsule 6	python-twisted-web	12.1.0-5.el7_2	RHSA-2018:2927
Red Hat Satellite Capsule 6	python-vine +1	1.1.3-4.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	python-werkzeug	0.9.1-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	python-zope-interface	4.0.5-4.el7	RHSA-2018:2927
Red Hat Satellite Capsule 6	qpid-cpp +6	1.36.0-19.el7	RHSA-2018:2927
Red Hat Satellite Capsule 6	qpid-dispatch +2	0.8.0-19.el7	RHSA-2018:2927
Red Hat Satellite Capsule 6	qpid-proton +2	0.16.0-12.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	redhat-access-insights-puppet	0.0.9-3.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	repoview	0.6.6-4.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	rubygem-ansi	1.4.3-3.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	rubygem-bundler_ext +1	0.4.1-3.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	rubygem-clamp +1	1.1.2-2.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	rubygem-concurrent-ruby	1:1.0.3-6.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	rubygem-fast_gettext	1.1.0-4.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	rubygem-ffi	1.4.0-3.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	rubygem-gssapi	1.1.2-4.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	rubygem-hashie +1	2.0.5-5.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	rubygem-highline +1	1.7.8-3.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	rubygem-kafo	2.1.0-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	rubygem-kafo_parsers	0.1.6-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	rubygem-kafo_wizards	0.0.1-2.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	rubygem-little-plugger +1	1.1.3-22.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	rubygem-logging	2.2.2-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	rubygem-mime-types	1.19-7.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	rubygem-multi_json	1.12.2-2.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	rubygem-netrc	0.7.7-9.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	rubygem-newt	0.9.6-3.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	rubygem-oauth +1	0.5.4-2.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	rubygem-openscap	0.4.7-3.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	rubygem-powerbar +1	1.0.17-2.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	rubygem-rack	1:1.6.4-3.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	rubygem-rack-protection	1.5.3-4.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	rubygem-rake	0.9.2.2-41.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	rubygem-rb-inotify	0.9.7-4.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	rubygem-rest-client	1.6.7-7.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	rubygem-rkerberos	0.1.3-5.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	rubygem-rsec	0.4.2-2.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	rubygem-rubyipmi	0.10.0-2.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	rubygem-sinatra	1:1.4.7-3.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	rubygem-smart_proxy_ansible	2.0.2-3.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	rubygem-smart_proxy_dhcp_remote_isc	0.0.4-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	rubygem-smart_proxy_discovery	1.0.4-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	rubygem-smart_proxy_discovery_image	1.0.9-2.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	rubygem-smart_proxy_dynflow +1	0.2.1-2.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	rubygem-smart_proxy_openscap	0.6.11-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	rubygem-smart_proxy_remote_execution_ssh	0.2.0-3.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	rubygem-tilt	1.3.7-2.git.0.3b416c9.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	saslwrapper +1	0.22-5.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	satellite +3	6.4.0-15.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	satellite-installer	6.4.0.7-2.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	tfm +1	4.0-3.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	tfm-ror51 +1	1.1-2.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	tfm-ror51-rubygem-concurrent-ruby +1	1.0.5-4.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	tfm-ror51-rubygem-mime-types	3.1-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	tfm-ror51-rubygem-mime-types-data	3.2016.0521-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	tfm-ror51-rubygem-multi_json	1.12.2-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	tfm-ror51-rubygem-mustermann	1.0.1-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	tfm-ror51-rubygem-rack	2.0.3-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	tfm-ror51-rubygem-sinatra +1	2.0.0-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	tfm-ror51-rubygem-sqlite3	1.3.13-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	tfm-ror51-rubygem-tilt	2.0.8-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	tfm-rubygem-algebrick	0.7.3-5.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	tfm-rubygem-apipie-bindings	0.2.2-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	tfm-rubygem-apipie-params	0.0.5-4.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	tfm-rubygem-awesome_print	1.8.0-2.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	tfm-rubygem-concurrent-ruby-edge	1:0.2.4-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	tfm-rubygem-domain_name	0.5.20160310-3.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	tfm-rubygem-dynflow	1.0.5.1-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	tfm-rubygem-fast_gettext	1.4.1-2.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	tfm-rubygem-ffi	1.4.0-11.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	tfm-rubygem-foreman-tasks-core	0.2.5-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	tfm-rubygem-foreman_ansible_core	2.1.1-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	tfm-rubygem-foreman_remote_execution_core	1.1.3-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	tfm-rubygem-gssapi	1.2.0-4.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	tfm-rubygem-hammer_cli	0.13.1-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	tfm-rubygem-hammer_cli_foreman_bootdisk	0.1.3.3-3.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	tfm-rubygem-hammer_cli_foreman_docker	0.0.6-3.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	tfm-rubygem-hammer_cli_foreman_tasks	0.0.12-2.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	tfm-rubygem-http-cookie	1.0.2-4.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	tfm-rubygem-locale	2.0.9-12.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	tfm-rubygem-logging	2.2.2-4.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	tfm-rubygem-net-ssh	4.0.1-4.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	tfm-rubygem-net-ssh-krb	0.4.0-2.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	tfm-rubygem-netrc	0.11.0-2.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	tfm-rubygem-rest-client	2.0.1-2.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	tfm-rubygem-sequel	5.7.1-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	tfm-rubygem-unf	0.1.3-6.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	tfm-rubygem-unf_ext	0.0.6-8.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	tfm-rubygem-unicode	0.4.4.1-5.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	v8	1:3.14.5.10-19.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	yaml-cpp	0.5.1-7.el7sat	RHSA-2018:2927
Red Hat Satellite 6	SOAPpy	0.11.6-17.el7	RHSA-2018:2927
Red Hat Satellite 6	ansiblerole-insights-client	1.5-1.el7sat	RHSA-2018:2927
Red Hat Satellite 6	candlepin +1	2.4.8-1.el7	RHSA-2018:2927
Red Hat Satellite 6	createrepo_c +1	0.7.4-1.el7sat	RHSA-2018:2927
Red Hat Satellite 6	foreman +13	1.18.0.37-1.el7sat	RHSA-2018:2927
Red Hat Satellite 6	foreman-bootloaders-redhat +1	201801241201-3.el7sat	RHSA-2018:2927
Red Hat Satellite 6	foreman-installer	1:1.18.0.2-1.el7sat	RHSA-2018:2927
Red Hat Satellite 6	foreman-proxy +1	1.18.0.1-1.el7sat	RHSA-2018:2927
Red Hat Satellite 6	gofer +2	2.12.1-1.el7sat	RHSA-2018:2927
Red Hat Satellite 6	hfsplus-tools	332.14-12.el7	RHSA-2018:2927
Red Hat Satellite 6	katello +4	3.7.0-8.el7sat	RHSA-2018:2927
Red Hat Satellite 6	katello-certs-tools	2.4.0-2.el7sat	RHSA-2018:2927
Red Hat Satellite 6	katello-client-bootstrap	1.6.0-1.el7sat	RHSA-2018:2927
Red Hat Satellite 6	katello-installer-base +1	3.7.0.10-1.el7sat	RHSA-2018:2927
Red Hat Satellite 6	katello-selinux	3.0.3-2.el7sat	RHSA-2018:2927
Red Hat Satellite 6	kobo	0.5.1-1.el7sat	RHSA-2018:2927
Red Hat Satellite 6	libwebsockets	2.1.0-3.el7	RHSA-2018:2927
Red Hat Satellite 6	liquibase	3.1.0-1.el7	RHSA-2018:2927
Red Hat Satellite 6	livecd-tools +1	1:20.4-1.6.el7sat	RHSA-2018:2927
Red Hat Satellite 6	mod_passenger	4.0.18-24.el7sat	RHSA-2018:2927
Red Hat Satellite 6	mod_xsendfile	0.12-10.el7sat	RHSA-2018:2927
Red Hat Satellite 6	ostree	2017.1-2.atomic.el7	RHSA-2018:2927
Red Hat Satellite 6	pcp-mmvstatsd	0.4-1.el7sat	RHSA-2018:2927
Red Hat Satellite 6	pulp +10	2.16.4.1-1.el7sat	RHSA-2018:2927
Red Hat Satellite 6	pulp-docker +3	3.1.4.1-1.el7sat	RHSA-2018:2927
Red Hat Satellite 6	pulp-katello	1.0.2-5.el7sat	RHSA-2018:2927
Red Hat Satellite 6	pulp-ostree +3	1.3.0-1.el7sat	RHSA-2018:2927
Red Hat Satellite 6	pulp-puppet +4	2.16.4-3.el7sat	RHSA-2018:2927
Red Hat Satellite 6	pulp-rpm +4	2.16.4.1-5.el7sat	RHSA-2018:2927
Red Hat Satellite 6	puppet-agent	5.5.0-2.el7sat	RHSA-2018:2927
Red Hat Satellite 6	puppet-agent-oauth	0.5.1-3.el7sat	RHSA-2018:2927
Red Hat Satellite 6	puppet-foreman_scap_client	0.3.16-3.el7sat	RHSA-2018:2927
Red Hat Satellite 6	puppetlabs-stdlib	4.2.1-1.20140510git08b00d9.el7sat	RHSA-2018:2927
Red Hat Satellite 6	puppetserver	5.3.1-1.el7sat	RHSA-2018:2927
Red Hat Satellite 6	python-amqp +1	2.2.2-3.el7sat	RHSA-2018:2927
Red Hat Satellite 6	python-anyjson	0.3.3-5.el7sat	RHSA-2018:2927
Red Hat Satellite 6	python-billiard +1	1:3.5.0.3-3.el7sat	RHSA-2018:2927
Red Hat Satellite 6	python-blinker	1.3-2.el7sat	RHSA-2018:2927
Red Hat Satellite 6	python-bson +2	3.2-1.el7sat	RHSA-2018:2927
Red Hat Satellite 6	python-celery +1	4.0.2-4.el7sat	RHSA-2018:2927
Red Hat Satellite 6	python-crane	3.1.1-1.el7sat	RHSA-2018:2927
Red Hat Satellite 6	python-django +1	1.11.11-1.el7sat	RHSA-2018:2927
Red Hat Satellite 6	python-flask	1:0.10.1-4.el7sat	RHSA-2018:2927
Red Hat Satellite 6	python-fpconst	0.7.3-12.el7	RHSA-2018:2927
Red Hat Satellite 6	python-gnupg	0.3.7-1.el7ui	RHSA-2018:2927
Red Hat Satellite 6	python-isodate	0.5.0-5.pulp.el7sat	RHSA-2018:2927
Red Hat Satellite 6	python-itsdangerous	0.23-1.el7sat	RHSA-2018:2927
Red Hat Satellite 6	python-jinja2	2.7.2-2.el7sat	RHSA-2018:2927
Red Hat Satellite 6	python-kid	0.9.6-11.el7sat	RHSA-2018:2927
Red Hat Satellite 6	python-kombu +1	1:4.0.2-8.el7sat	RHSA-2018:2927
Red Hat Satellite 6	python-mongoengine	0.10.5-2.el7sat	RHSA-2018:2927
Red Hat Satellite 6	python-nectar	1.5.6-1.el7sat	RHSA-2018:2927
Red Hat Satellite 6	python-oauth2	1.5.211-8.el7sat	RHSA-2018:2927
Red Hat Satellite 6	python-okaara	1.0.32-1.el7sat	RHSA-2018:2927
Red Hat Satellite 6	python-qpid	1.35.0-5.el7	RHSA-2018:2927
Red Hat Satellite 6	python-saslwrapper	0.22-5.el7sat	RHSA-2018:2927
Red Hat Satellite 6	python-semantic_version	2.2.0-6.el7sat	RHSA-2018:2927
Red Hat Satellite 6	python-simplejson	3.2.0-1.el7sat	RHSA-2018:2927
Red Hat Satellite 6	python-twisted-core	12.2.0-4.el7	RHSA-2018:2927
Red Hat Satellite 6	python-twisted-web	12.1.0-5.el7_2	RHSA-2018:2927
Red Hat Satellite 6	python-vine +1	1.1.3-4.el7sat	RHSA-2018:2927
Red Hat Satellite 6	python-werkzeug	0.9.1-1.el7sat	RHSA-2018:2927
Red Hat Satellite 6	python-zope-interface	4.0.5-4.el7	RHSA-2018:2927
Red Hat Satellite 6	qpid-cpp +7	1.36.0-19.el7	RHSA-2018:2927
Red Hat Satellite 6	qpid-dispatch +2	0.8.0-19.el7	RHSA-2018:2927
Red Hat Satellite 6	qpid-proton +2	0.16.0-12.el7sat	RHSA-2018:2927
Red Hat Satellite 6	redhat-access-insights-puppet	0.0.9-3.el7sat	RHSA-2018:2927
Red Hat Satellite 6	repoview	0.6.6-4.el7sat	RHSA-2018:2927
Red Hat OpenStack 13	python-django +2	1.11.11-1.el7ost	RHSA-2019:0082

Show 2 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Red Hat OpenStack 10	python-django +1	1.8.19-1.el7ost	RHSA-2019:0051
Red Hat Gluster Storage 3	carbon-selinux +3	1.5.4-3.el7rhgs	RHSA-2019:0265
Red Hat Gluster Storage 3	graphite-web +2	1.1.4-1.el7rhgs	RHSA-2019:0265
Red Hat Gluster Storage 3	python-cachetools	1.0.3-1.1.el7rhgs	RHSA-2019:0265
Red Hat Gluster Storage 3	python-django +3	1.11.15-4.el7rhgs	RHSA-2019:0265
Red Hat Gluster Storage 3	python-django-tagging	0.4.6-1.el7rhgs	RHSA-2019:0265
Red Hat Gluster Storage 3	python-scandir	1.3-1.el7rhgs	RHSA-2019:0265
Red Hat Gluster Storage 3	tendrl-ansible	1.6.3-11.el7rhgs	RHSA-2019:0265
Red Hat Gluster Storage 3	tendrl-api +1	1.6.3-10.el7rhgs	RHSA-2019:0265
Red Hat Gluster Storage 3	tendrl-commons +1	1.6.3-15.el7rhgs	RHSA-2019:0265
Red Hat Gluster Storage 3	tendrl-grafana-plugins +1	1.6.3-20.el7rhgs	RHSA-2019:0265

SUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
SUSE Package Hub 12 SP1	python-Django	1.11.15-2.1	openSUSE-SU-2023:0077-1
SUSE Package Hub 12	python-Django	1.11.11-8.1	openSUSE-SU-2018:0651-1
SUSE OpenStack Cloud 7	python-Django	1.8.19-3.4.1	SUSE-SU-2018:0973-1

Show 3 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
SUSE OpenStack Cloud 6	python-Django	1.8.19-3.6.1	SUSE-SU-2018:1102-1
SUSE Enterprise Storage 5	python-Django	1.6.11-6.5.1	SUSE-SU-2018:1830-1
SUSE Enterprise Storage 4	python-Django	1.6.11-5.5.1	SUSE-SU-2018:1828-1

openSUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
openSUSE Tumbleweed	python-Django	3.2.7-2.3	openSUSE-SU-2026:11248-1, openSUSE-SU-2024:13887-1, openSUSE-SU-2024:11205-1
openSUSE Tumbleweed	python-Django4	4.2.14-1.1	openSUSE-SU-2026:11235-1, openSUSE-SU-2024:14208-1
openSUSE Tumbleweed	python-Django5	5.2.16-1.1	openSUSE-SU-2026:11270-1
openSUSE Tumbleweed	python-Django6	6.0-1.1	openSUSE-SU-2026:10005-1

Alpine

Security tracker ↗

Release	Package	Fixed in	Advisory
Alpine v3.24	py3-django	1.11.11-r0	—
Alpine v3.23	py3-django	1.11.11-r0	—
Alpine v3.22	py3-django	1.11.11-r0	—
Alpine v3.21	py3-django	1.11.11-r0	—
Alpine v3.20	py3-django	1.11.11-r0	—

Show 16 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Alpine v3.19	py3-django	1.11.11-r0	—
Alpine v3.18	py3-django	1.11.11-r0	—
Alpine v3.17	py3-django	1.11.11-r0	—
Alpine v3.16	py3-django	1.11.11-r0	—
Alpine v3.15	py3-django	1.11.11-r0	—
Alpine v3.14	py3-django	1.11.11-r0	—
Alpine v3.13	py3-django	1.11.11-r0	—
Alpine v3.12	py3-django	1.11.11-r0	—
Alpine v3.11	py3-django	1.11.11-r0	—
Alpine v3.10	py-django	1.11.11-r0	—
Alpine v3.9	py-django	1.11.11-r0	—
Alpine v3.8	py-django	1.11.11-r0	—
Alpine v3.7	py-django	1.11.11-r0	—
Alpine v3.6	py-django	1.11.11-r0	—
Alpine v3.5	py-django	1.8.19-r0	—
Alpine v3.4	py-django	1.8.19-r0	—

Affected packages

Ecosystem	Package	Affected	Fixed	Record
PyPI	django	>= 2.0a1, < 2.0.3	2.0.3	GHSA-r28v-mw67-m5p9
PyPI	django	>= 1.11a1, < 1.11.11	1.11.11	GHSA-r28v-mw67-m5p9
PyPI	django	>= 1.8a1, < 1.8.19	1.8.19	GHSA-r28v-mw67-m5p9
PyPI	django	>= 1.8, < 1.8.19 · >= 1.11, < 1.11.11 · >= 2.0, < 2.0.3	1.8.19, 1.11.11, 2.0.3	PYSEC-2018-5

Advisories 20

RHSA-2018:2927 Red Hat Security Advisory: Satellite 6.4 security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Aug 5, 2026
openSUSE-SU-2026:11270-1 python313-Django5-5.2.16-1.1 on GA media SUSE / openSUSE Security Updates · Jul 15, 2026
openSUSE-SU-2026:11248-1 python313-Django-5.2.16-1.1 on GA media SUSE / openSUSE Security Updates · Jul 11, 2026
openSUSE-SU-2026:11235-1 python313-Django4-4.2.30-4.1 on GA media SUSE / openSUSE Security Updates · Jul 10, 2026
RHSA-2019:0265 Red Hat Security Advisory: Red Hat Gluster Storage Web Administration security update Red Hat Security Advisories (RHSA) · Jun 28, 2026
RHSA-2019:0082 Red Hat Security Advisory: python-django security update Red Hat Security Advisories (RHSA) · Jun 28, 2026
RHSA-2019:0051 Red Hat Security Advisory: python-django security update Red Hat Security Advisories (RHSA) · Jun 28, 2026
openSUSE-SU-2026:10005-1 python312-Django6-6.0-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
DSA-4161-1 python-django - security update Debian Security (DSA / DLA) · Mar 9, 2026
DLA-1303-1 python-django - security update Debian Security (DSA / DLA) · Mar 9, 2026
USN-3591-1 python-django vulnerabilities Ubuntu Security Notices (USN) · Feb 10, 2026
openSUSE-SU-2024:11205-1 python36-Django-3.2.7-2.3 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
openSUSE-SU-2018:0651-1 Security update for python-Django SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2018:1102-1 Security update for python-Django SUSE / openSUSE Security Updates · Feb 4, 2026
openSUSE-SU-2024:13887-1 python310-Django-4.2.11-2.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2018:0973-1 Security update for python-Django SUSE / openSUSE Security Updates · Feb 4, 2026
openSUSE-SU-2023:0077-1 Security update for python-Django SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2018:1830-1 Security update for python-Django SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2018:1828-1 Security update for python-Django SUSE / openSUSE Security Updates · Feb 4, 2026
openSUSE-SU-2024:14208-1 python310-Django4-4.2.14-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026

References

USN-3591-1 vendor-advisory
RHSA-2019:0051 vendor-advisory
[debian-lts-announce] 20180308 [SECURITY] [DLA 1303-1] python-django security update mailing-list
103361 vdb-entry
https://www.djangoproject.com/weblog/2018/mar/06/security-releases/
RHSA-2019:0082 vendor-advisory
RHSA-2018:2927 vendor-advisory
RHSA-2019:0265 vendor-advisory
DSA-4161 vendor-advisory
https://github.com/django/django/commit/1ca63a66ef3163149ad822701273e8a1844192c2
https://github.com/django/django/commit/abf89d729f210c692a50e0ad3f75fb6bec6fae16
https://github.com/django/django/commit/e157315da3ae7005fa0683ffc9751dbeca7306c8