CVE-2013-1664 XML Entity Expansion (XEE) in Django
Remote attackers can cause denial of service via XML Entity Expansion in Python XML libraries, affecting OpenStack and Django.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2013-1664?
CVE-2013-1664 is a medium-severity denial of service vulnerability in n/a, published on 3 Apr 2013. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The XML libraries for Python 3.4, 3.3, 3.2, 3.1, 2.7, and 2.6, as used in OpenStack Keystone Essex, Folsom, and Grizzly; Compute (Nova) Essex and Folsom; Cinder Folsom; Django; and possibly other products allow remote attackers to cause a denial of service (resource consumption and crash) via an XML Entity Expansion (XEE) attack.
Weakness: CWE-119
Which versions are affected by CVE-2013-1664?
5 open source packages ship an affected version, including django and Django. It affects 6 products.
| Package | Affected | Fixed in |
|---|---|---|
django PyPI | From 1.3.0 | 1.3.6, 1.4.4 |
django PyPI | From 1.3.0 | 1.3.6 |
django PyPI | From 1.4.0 | 1.4.4 |
Django PyPI | From 1.3.0 | 1.3.6 |
Django PyPI | From 1.4.0 | 1.4.4 |
Products include Openstack Cinder Folsom, Openstack Compute \(Nova\) Essex, Openstack Compute \(Nova\) Folsom, Openstack Folsom, Openstack Grizzly, Openstack Keystone Essex.
How do I fix CVE-2013-1664?
Upgrade django to a fixed version for your release line: 1.3.6 or 1.4.4.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2013-1664 being exploited?
There is no known exploitation of CVE-2013-1664 in the wild and no public exploit code.
Sources
Also known as CVE-2013-0278, CVE-2013-0279, CVE-2013-0280, DEBIAN-CVE-2013-1664, GHSA-qrh7-x6fp-c2mp, PYSEC-2026-801.