CVE-2013-1665 XML External Entity (XXE) in Django
Remote attackers can read arbitrary files via XML External Entity attacks in Python XML libraries, affecting applications like OpenStack and Django.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2013-1665?
CVE-2013-1665 is a medium-severity vulnerability in n/a, published on 3 Apr 2013. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The XML libraries for Python 3.4, 3.3, 3.2, 3.1, 2.7, and 2.6, as used in OpenStack Keystone Essex and Folsom, Django, and possibly other products allow remote attackers to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, aka an XML External Entity (XXE) attack.
Weakness: CWE-200
Which versions are affected by CVE-2013-1665?
5 open source packages ship an affected version, including django and Django. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
django PyPI | From 1.3.0 | 1.3.6, 1.4.4 |
django PyPI | From 1.3.0 | 1.3.6 |
django PyPI | From 1.4.0 | 1.4.4 |
Django PyPI | From 1.3.0 | 1.3.6 |
Django PyPI | From 1.4.0 | 1.4.4 |
Products include Openstack Folsom, Openstack Keystone Essex.
How do I fix CVE-2013-1665?
Upgrade django to a fixed version for your release line: 1.3.6 or 1.4.4.
Is CVE-2013-1665 being exploited?
There is no known exploitation of CVE-2013-1665 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2013-2161 OpenStack Swift Unchecked user input in XML responses
- CVE-2013-4497 OpenStack Compute Nova Improper Access Control
- CVE-2012-3447 Arbitrary file overwrite in OpenStack Nova
- CVE-2012-5625 OpenStack Nova Information leak in libvirt LVM-backed instances
- CVE-2013-4155 OpenStack Swift allows authenticated users to cause a denial of service
Sources
Also known as DEBIAN-CVE-2013-1665, GHSA-x64m-686f-fmm3, PYSEC-2026-802.