PT-2013-3303 · Python+2 · Python+2

Jonathan Murray · Publicado 2013-04-03 · Atualizado 2022-05-17 · CVE-2013-1665

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Python versions 3.4, 3.3, 3.2, 3.1, 2.7, and 2.6

Description The issue allows remote attackers to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, also known as an XML External Entity (XXE) attack. This affects products using the XML libraries for Python, including OpenStack Keystone Essex and Folsom, and Django.

Recommendations For Python versions 3.4, 3.3, 3.2, 3.1, 2.7, and 2.6, consider disabling the XML external entity processing to prevent XXE attacks until a patch is available. Restrict access to sensitive files and directories to minimize the risk of exploitation. Avoid using XML libraries that do not properly validate external entity declarations. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

XXE

Enumeração de Fraquezas

CWE-200

CWE-611

Identificadores relacionados

CVE-2013-1665

DSA-2634-1

GHSA-X64M-686F-FMM3

RHSA-2013:0596

RHSA-2013:0657

RHSA-2013:0658

RHSA-2013:0670

Produtos afetados

Django

Openstack Keystone

Python

Referências · 18

• https://github.com/django/django/commit/d19a27066b2247102e65412aa66917aff0091112 · Nota
• https://github.com/django/django/commit/1c60d07ba23e0350351c278ad28d0bd5aa410b40 · Nota
• https://osv.dev/vulnerability/GHSA-x64m-686f-fmm3 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2013/02/19/4 · Nota
• http://rhn.redhat.com/errata/RHSA-2013-0670.html · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2013-1665 · Aviso do Fabricante
• http://ubuntu.com/usn/usn-1757-1 · Aviso do Fabricante
• http://rhn.redhat.com/errata/RHSA-2013-0658.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2013-1665 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2013-1665 · Aviso do Fabricante
• http://debian.org/security/2013/dsa-2634 · Aviso do Fabricante
• http://rhn.redhat.com/errata/RHSA-2013-0657.html · Aviso do Fabricante
• https://bugs.launchpad.net/keystone/+bug/1100279 · Correção
• http://blog.python.org/2013/02/announcing-defusedxml-fixes-for-xml.html · Nota
• http://bugs.python.org/issue17239 · Nota