VulnerableCode Package Details - pkg:alpm/archlinux/python-django@1.11.10-1

Search for packages

Vulnerability	Summary	Fixed by
VCID-jae8-w85w-cyfu Aliases: CVE-2018-7537 GHSA-2f9x-5v75-3qv4 PYSEC-2018-6	An issue was discovered in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19. If django.utils.text.Truncator's chars() and words() methods were passed the html=True argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking vulnerability in a regular expression. The chars() and words() methods are used to implement the truncatechars_html and truncatewords_html template filters, which were thus vulnerable.	1.11.11-1 Affected by 0 other vulnerabilities.
VCID-mv1p-yxvp-pbh6 Aliases: CVE-2018-7536 GHSA-r28v-mw67-m5p9 PYSEC-2018-5	An issue was discovered in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19. The django.utils.html.urlize() function was extremely slow to evaluate certain inputs due to catastrophic backtracking vulnerabilities in two regular expressions (only one regular expression for Django 1.8.x). The urlize() function is used to implement the urlize and urlizetrunc template filters, which were thus vulnerable.	1.11.11-1 Affected by 0 other vulnerabilities.

Vulnerability

Summary

Fixed by

VCID-jae8-w85w-cyfu
Aliases:
CVE-2018-7537
GHSA-2f9x-5v75-3qv4
PYSEC-2018-6

An issue was discovered in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19. If django.utils.text.Truncator's chars() and words() methods were passed the html=True argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking vulnerability in a regular expression. The chars() and words() methods are used to implement the truncatechars_html and truncatewords_html template filters, which were thus vulnerable.

1.11.11-1
Affected by 0 other vulnerabilities.

VCID-mv1p-yxvp-pbh6
Aliases:
CVE-2018-7536
GHSA-r28v-mw67-m5p9
PYSEC-2018-5

An issue was discovered in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19. The django.utils.html.urlize() function was extremely slow to evaluate certain inputs due to catastrophic backtracking vulnerabilities in two regular expressions (only one regular expression for Django 1.8.x). The urlize() function is used to implement the urlize and urlizetrunc template filters, which were thus vulnerable.

1.11.11-1
Affected by 0 other vulnerabilities.

Vulnerability	Summary	Aliases
VCID-27wt-wmzc-1bc2	django.contrib.auth.forms.AuthenticationForm in Django 2.0 before 2.0.2, and 1.11.8 and 1.11.9, allows remote attackers to obtain potentially sensitive information by leveraging data exposure from the confirm_login_allowed() method, as demonstrated by discovering whether a user account is inactive.	CVE-2018-6188 GHSA-rf4j-j272-fj86 PYSEC-2018-4

Vulnerability

Summary

Aliases

VCID-27wt-wmzc-1bc2

django.contrib.auth.forms.AuthenticationForm in Django 2.0 before 2.0.2, and 1.11.8 and 1.11.9, allows remote attackers to obtain potentially sensitive information by leveraging data exposure from the confirm_login_allowed() method, as demonstrated by discovering whether a user account is inactive.

CVE-2018-6188
GHSA-rf4j-j272-fj86
PYSEC-2018-4

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-04-01T18:27:06.323945+00:00	Arch Linux Importer	Fixing	VCID-27wt-wmzc-1bc2	https://security.archlinux.org/AVG-624	38.0.0
2026-04-01T18:27:05.883899+00:00	Arch Linux Importer	Affected by	VCID-mv1p-yxvp-pbh6	https://security.archlinux.org/AVG-649	38.0.0
2026-04-01T18:27:05.855793+00:00	Arch Linux Importer	Affected by	VCID-jae8-w85w-cyfu	https://security.archlinux.org/AVG-649	38.0.0