~ / search / GHSA-x64m-686f-fmm3

GHSA-x64m-686f-fmm3

XML External Entity (XXE) in Django

Source: GitHub Advisory Database (reviewed) Moderate CVE-2013-1665

Packages

EcosystemPackageAffectedFixed in
PyPI Django >= 1.3.0, < 1.3.6 1.3.6
PyPI Django >= 1.4.0, < 1.4.4 1.4.4

Details

As written in the advisory (Markdown source, shown as plain text).

The XML libraries for Python as used in OpenStack Keystone Essex and Folsom, Django, and possibly other products allow remote attackers to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, aka an XML External Entity (XXE) attack.

References

External links from the advisory. They lead to third-party sites.