Patchwire CVEs, their patch status, and feeds to follow them

CVE-2013-1665

Fixed in a distro release EPSS 5%

The XML libraries for Python 3.4, 3.3, 3.2, 3.1, 2.7, and 2.6, as used in OpenStack Keystone Essex and Folsom, Django, and possibly other products allow remote attackers to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, aka an XML External Entity (XXE) attack.

Published 2013-04-03 · CVE record · OSV

Products: openstack folsom, openstack keystone_essex

Fixed upstream

EcosystemPackageFixed in
PyPIdjango1.3.6
PyPIdjango1.4.4

Distro releases

ReleasePackageFixed in
Debian 12keystone2012.1.1-13
Debian 12python-django1.4.4-1
Debian 13keystone2012.1.1-13
Debian 13python-django1.4.4-1
Debian 14keystone2012.1.1-13
Debian 14python-django1.4.4-1
Debian 6.0python-django1.2.3-3+squeeze5
Red Hat openstack 2Django140:1.4.4-1.el6ost
Red Hat openstack 2Django14-doc0:1.4.4-1.el6ost
Red Hat openstack 2openstack-cinder0:2012.2.3-4.el6ost
Red Hat openstack 2openstack-cinder-doc0:2012.2.3-4.el6ost
Red Hat openstack 2openstack-keystone0:2012.2.3-3.el6ost
Red Hat openstack 2openstack-keystone-doc0:2012.2.3-3.el6ost
Red Hat openstack 2openstack-nova0:2012.2.3-4.el6ost
Red Hat openstack 2openstack-nova-api0:2012.2.3-4.el6ost
Red Hat openstack 2openstack-nova-cert0:2012.2.3-4.el6ost
Red Hat openstack 2openstack-nova-common0:2012.2.3-4.el6ost
Red Hat openstack 2openstack-nova-compute0:2012.2.3-4.el6ost
Red Hat openstack 2openstack-nova-console0:2012.2.3-4.el6ost
Red Hat openstack 2openstack-nova-doc0:2012.2.3-4.el6ost
Red Hat openstack 2openstack-nova-network0:2012.2.3-4.el6ost
Red Hat openstack 2openstack-nova-objectstore0:2012.2.3-4.el6ost
Red Hat openstack 2openstack-nova-scheduler0:2012.2.3-4.el6ost
Red Hat openstack 2openstack-nova-volume0:2012.2.3-4.el6ost
Red Hat openstack 2python-cinder0:2012.2.3-4.el6ost
Red Hat openstack 2python-keystone0:2012.2.3-3.el6ost
Red Hat openstack 2python-nova0:2012.2.3-4.el6ost