FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

CVE-2013-1665

This CVE name corresponds to:

Entered	Topic
2013-02-24	django -- multiple vulnerabilities

The following information is adapted from the Common Vulnerabilities and Exposures (CVE) project. CVE and the CVE logo are trademarks of The MITRE Corporation. CVE content is Copyright 2005, The MITRE Corporation.

CVE-2013-1665 at cve.mitre.org

Details

Type	Candidate
Name	CVE-2013-1665
Phase	Assigned(20130213)

Description

The XML libraries for Python 3.4, 3.3, 3.2, 3.1, 2.7, and 2.6, as used in OpenStack Keystone Essex and Folsom, Django, and possibly other products allow remote attackers to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, aka an XML External Entity (XXE) attack.

References

Source	Reference
MLIST	[openstack-announce] 20130219 [OSSA 2013-004] Information leak and Denial of Service using XML entities (CVE-2013-1664, CVE-2013-1665)
MLIST	[oss-security] 20130219 [OSSA 2013-004] Information leak and Denial of Service using XML entities (CVE-2013-1664, CVE-2013-1665)
MLIST	[oss-security] 20130219 REJECT CVE-2013-0278, CVE-2013-0279 and CVE-2013-0280
CONFIRM	http://blog.python.org/2013/02/announcing-defusedxml-fixes-for-xml.html
CONFIRM	http://bugs.python.org/issue17239
CONFIRM	https://bugs.launchpad.net/keystone/+bug/1100279
DEBIAN	DSA-2634
REDHAT	RHSA-2013:0658
REDHAT	RHSA-2013:0657
REDHAT	RHSA-2013:0670
UBUNTU	USN-1757-1