GitHub Advisoryadvisory · PyPI
GHSA-x64m-686f-fmm3 XML External Entity (XXE) in Django
MEDIUM
Official page ↗
- Aliases
- CVE-2013-1665
- Ecosystem
- PyPI
- Packages
- Django
- Severity
- Moderate
- Weaknesses
- CWE-200, CWE-611
- Reviewed
- 2024-05-21
Affected packages
• PyPI Django: >= 1.3.0, < 1.3.6 → fixed in 1.3.6
• PyPI Django: >= 1.4.0, < 1.4.4 → fixed in 1.4.4
Description
The XML libraries for Python as used in OpenStack Keystone Essex and Folsom, Django, and possibly other products allow remote attackers to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, aka an XML External Entity (XXE) attack.
Related
Alias · CVE (1)
- CVE-2013-1665 The XML libraries for Python 3.4, 3.3, 3.2, 3.1, 2.7, and 2.6, as used in OpenStack Keystone Essex and Folsom, Django, and possibly other… vulnerability
References
- https://nvd.nist.gov/vuln/detail/CVE-2013-1665 advisory
- https://github.com/django/django/commit/1c60d07ba23e0350351c278ad28d0bd5aa410b40 web
- https://github.com/django/django/commit/d19a27066b2247102e65412aa66917aff0091112 web
- https://bugs.launchpad.net/keystone/+bug/1100279 web
- http://blog.python.org/2013/02/announcing-defusedxml-fixes-for-xml.html web
- http://bugs.python.org/issue17239 web
- http://lists.openstack.org/pipermail/openstack-announce/2013-February/000078.html web
- http://rhn.redhat.com/errata/RHSA-2013-0657.html web
- http://rhn.redhat.com/errata/RHSA-2013-0658.html web
- http://rhn.redhat.com/errata/RHSA-2013-0670.html web
- http://ubuntu.com/usn/usn-1757-1 web
- http://www.debian.org/security/2013/dsa-2634 web
- http://www.openwall.com/lists/oss-security/2013/02/19/2 web
- http://www.openwall.com/lists/oss-security/2013/02/19/4 web