{"id":"CVE-2013-1664","published":"2013-04-03T00:00:00Z","modified":"2024-08-06T15:13:32Z","title":"The XML libraries for Python 3.4, 3.3, 3.2, 3.1, 2.7, and 2.6, as used in OpenStack Keystone Essex, Folsom, and…","vendor":null,"product":null,"tier":"tail","description":{"text":"The XML libraries for Python 3.4, 3.3, 3.2, 3.1, 2.7, and 2.6, as used in OpenStack Keystone Essex, Folsom, and Grizzly; Compute (Nova) Essex and Folsom; Cinder Folsom; Django; and possibly other products allow remote attackers to cause a denial of service (resource consumption and crash) via an XML Entity Expansion (XEE) attack.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.04771,"percentile":0.91877,"provenance":"source"},"cwes":[],"references":[{"url":"http://www.openwall.com/lists/oss-security/2013/02/19/4","tags":["mailing-list","x_refsource_MLIST"]},{"url":"http://lists.openstack.org/pipermail/openstack-announce/2013-February/000078.html","tags":["mailing-list","x_refsource_MLIST"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-0658.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://www.openwall.com/lists/oss-security/2013/02/19/2","tags":["mailing-list","x_refsource_MLIST"]},{"url":"http://ubuntu.com/usn/usn-1757-1","tags":["vendor-advisory","x_refsource_UBUNTU"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-0657.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://bugs.launchpad.net/nova/+bug/1100282","tags":["x_refsource_CONFIRM"]},{"url":"http://blog.python.org/2013/02/announcing-defusedxml-fixes-for-xml.html","tags":["x_refsource_CONFIRM"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-0670.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://bugs.python.org/issue17239","tags":["x_refsource_CONFIRM"]}],"priority":{"score":18.4,"factors":[{"name":"EPSS percentile","points":18.38}]},"affected":[{"ecosystem":"PyPI","package":"Django","vulnerableRanges":[">=1.3.0, <1.3.6",">=1.4.0, <1.4.4"],"patched":["1.3.6","1.4.4"],"from":["GHSA-qrh7-x6fp-c2mp","PYSEC-2026-801"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-5025","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-django-cve-2013-1664","children":[{"from":"CVE-2013-1664","to":"CVE-2013-4179","relation":"incomplete-fix","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"NOTE: this issue is due to an incomplete fix for CVE-2013-1664.","from":"CVE.org","in":"CVE-2013-4179"}]},{"from":"CVE-2013-1664","to":"CVE-2013-4202","relation":"incomplete-fix","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"NOTE: this issue is due to an incomplete fix for CVE-2013-1664.","from":"CVE.org","in":"CVE-2013-4202"}]}]}}