Debian: DLA-1303-1 Critical: Python-Django Catastrophic Backtracking Issue

CVE-2018-7536

The django.utils.html.urlize() function was extremely slow to evaluate
certain inputs due to catastrophic backtracking vulnerabilities in two
regular expressions. The urlize() function is used to implement the urlize
and urlizetrunc template filters, which were thus vulnerable.

The problematic regular expressions are replaced with parsing logic that
behaves similarly.

CVE-2018-7537

If django.utils.text.Truncator’s chars() and words() methods were passed
the html=True argument, they were extremely slow to evaluate certain inputs
due to a catastrophic backtracking vulnerability in a regular expression.
The chars() and words() methods are used to implement the truncatechars_html
and truncatewords_html template filters, which were thus vulnerable.

The backtracking problem in the regular expression is fixed.

For Debian 7 "Wheezy", these problems have been fixed in version
1.4.22-1+deb7u4.