PT-2013-3303 · Python+2 · Python+2

Jonathan Murray · Published 2013-04-03 · Updated 2022-05-17 · CVE-2013-1665

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Python versions 3.4, 3.3, 3.2, 3.1, 2.7, and 2.6

Description The issue allows remote attackers to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, also known as an XML External Entity (XXE) attack. This affects products using the XML libraries for Python, including OpenStack Keystone Essex and Folsom, and Django.

Recommendations For Python versions 3.4, 3.3, 3.2, 3.1, 2.7, and 2.6, consider disabling the XML external entity processing to prevent XXE attacks until a patch is available. Restrict access to sensitive files and directories to minimize the risk of exploitation. Avoid using XML libraries that do not properly validate external entity declarations. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

XXE

Weakness Enumeration

CWE-200

CWE-611

Related Identifiers

CVE-2013-1665

DSA-2634-1

GHSA-X64M-686F-FMM3

RHSA-2013:0596

RHSA-2013:0657

RHSA-2013:0658

RHSA-2013:0670

Affected Products

Django

Openstack Keystone

Python

References · 18

• https://osv.dev/vulnerability/GHSA-x64m-686f-fmm3 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2013-0670.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2013-1665 · Vendor Advisory
• http://ubuntu.com/usn/usn-1757-1 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2013-0658.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-1665 · Security Note
• https://osv.dev/vulnerability/CVE-2013-1665 · Vendor Advisory
• http://debian.org/security/2013/dsa-2634 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2013-0657.html · Vendor Advisory
• https://bugs.launchpad.net/keystone/+bug/1100279 · Patch
• http://lists.openstack.org/pipermail/openstack-announce/2013-February/000078.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2013-1665 · Vendor Advisory
• https://github.com/django/django/commit/d19a27066b2247102e65412aa66917aff0091112 · Note
• https://github.com/django/django/commit/1c60d07ba23e0350351c278ad28d0bd5aa410b40 · Note
• http://openwall.com/lists/oss-security/2013/02/19/4 · Note