mirrors/django
1
0
Fork 0
mirror of https://github.com/django/django.git synced 2025-10-31 09:41:08 +00:00
Code Issues 32 Releases Wiki Activity

Fixed CVE-2018-7536 -- Fixed catastrophic backtracking in urlize and urlizetrunc template filters.

Browse Source 
Thanks Florian Apolloner for assisting with the patch.
This commit is contained in:
Tim Graham
2018-02-24 11:30:11 -05:00
parent 4d2a2c83c7
commit 8618271caa
5 changed files with 63 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
docs/releases/1.11.11.txt
View File

@@ -5,3 +5,14 @@ Django 1.11.11 release notes
*March 6, 2018*
Django 1.11.11 fixes two security issues in 1.11.10.
CVE-2018-7536: Denial-of-service possibility in ``urlize`` and ``urlizetrunc`` template filters
===============================================================================================
The ``django.utils.html.urlize()`` function was extremely slow to evaluate
certain inputs due to catastrophic backtracking vulnerabilities in two regular
expressions. The ``urlize()`` function is used to implement the ``urlize`` and
``urlizetrunc`` template filters, which were thus vulnerable.
The problematic regular expressions are replaced with parsing logic that
behaves similarly.