FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

CVE-2013-1664

This CVE name corresponds to:

Entered	Topic
2013-02-24	django -- multiple vulnerabilities

The following information is adapted from the Common Vulnerabilities and Exposures (CVE) project. CVE and the CVE logo are trademarks of The MITRE Corporation. CVE content is Copyright 2005, The MITRE Corporation.

CVE-2013-1664 at cve.mitre.org

Details

Type	Candidate
Name	CVE-2013-1664
Phase	Assigned(20130213)

Description

The XML libraries for Python 3.4, 3.3, 3.2, 3.1, 2.7, and 2.6, as used in OpenStack Keystone Essex, Folsom, and Grizzly; Compute (Nova) Essex and Folsom; Cinder Folsom; Django; and possibly other products allow remote attackers to cause a denial of service (resource consumption and crash) via an XML Entity Expansion (XEE) attack.

References

Source	Reference
MLIST	[openstack-announce] 20130219 [OSSA 2013-004] Information leak and Denial of Service using XML entities (CVE-2013-1664, CVE-2013-1665)
MLIST	[oss-security] 20130219 [OSSA 2013-004] Information leak and Denial of Service using XML entities (CVE-2013-1664, CVE-2013-1665)
MLIST	[oss-security] 20130219 REJECT CVE-2013-0278, CVE-2013-0279 and CVE-2013-0280
CONFIRM	http://blog.python.org/2013/02/announcing-defusedxml-fixes-for-xml.html
CONFIRM	http://bugs.python.org/issue17239
CONFIRM	https://bugs.launchpad.net/nova/+bug/1100282
REDHAT	RHSA-2013:0658
REDHAT	RHSA-2013:0657
REDHAT	RHSA-2013:0670
UBUNTU	USN-1757-1