CVE-2013-1664: XML Entity Expansion (XEE) in Django

May 17, 2022 (updated May 21, 2024)

The XML libraries for Python, as used in OpenStack Keystone Essex, Folsom, and Grizzly; Compute (Nova) Essex and Folsom; Cinder Folsom; Django; and possibly other products allow remote attackers to cause a denial of service (resource consumption and crash) via an XML Entity Expansion (XEE) attack.

References

bugs.launchpad.net/nova/+bug/1100282
github.com/advisories/GHSA-qrh7-x6fp-c2mp
github.com/django/django
github.com/django/django/commit/1c60d07ba23e0350351c278ad28d0bd5aa410b40
github.com/django/django/commit/d19a27066b2247102e65412aa66917aff0091112
nvd.nist.gov/vuln/detail/CVE-2013-1664

Code Behaviors & Features

Detect and mitigate CVE-2013-1664 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →