GitHub Advisoryadvisory · PyPI

GHSA-qrh7-x6fp-c2mp XML Entity Expansion (XEE) in Django

MEDIUM Published 2022-05-17 Modified 2024-05-21 Official page ↗
Aliases
CVE-2013-1664
Ecosystem
PyPI
Packages
Django
Severity
Moderate
Weaknesses
CWE-611
Reviewed
2024-05-21

Affected packages

• PyPI Django: >= 1.3.0, < 1.3.6 → fixed in 1.3.6 • PyPI Django: >= 1.4.0, < 1.4.4 → fixed in 1.4.4

Description

The XML libraries for Python, as used in OpenStack Keystone Essex, Folsom, and Grizzly; Compute (Nova) Essex and Folsom; Cinder Folsom; Django; and possibly other products allow remote attackers to cause a denial of service (resource consumption and crash) via an XML Entity Expansion (XEE) attack.

Related

Alias · CVE (1)

  • CVE-2013-1664 The XML libraries for Python 3.4, 3.3, 3.2, 3.1, 2.7, and 2.6, as used in OpenStack Keystone Essex, Folsom, and Grizzly; Compute (Nova)… vulnerability

Weakness · CWE (1)

  • CWE-611 Improper Restriction of XML External Entity Reference weakness

References