~ / search / GHSA-qrh7-x6fp-c2mp

GHSA-qrh7-x6fp-c2mp

XML Entity Expansion (XEE) in Django

Source: GitHub Advisory Database (reviewed) Moderate CVE-2013-1664

Packages

EcosystemPackageAffectedFixed in
PyPI Django >= 1.3.0, < 1.3.6 1.3.6
PyPI Django >= 1.4.0, < 1.4.4 1.4.4

Details

As written in the advisory (Markdown source, shown as plain text).

The XML libraries for Python, as used in OpenStack Keystone Essex, Folsom, and Grizzly; Compute (Nova) Essex and Folsom; Cinder Folsom; Django; and possibly other products allow remote attackers to cause a denial of service (resource consumption and crash) via an XML Entity Expansion (XEE) attack.

References

External links from the advisory. They lead to third-party sites.