| Vulnerability Name: | CVE-2013-1664 (CCN-82202) | ||||||||||||||||||||||||||||
| Assigned: | 2013-02-20 | ||||||||||||||||||||||||||||
| Published: | 2013-02-20 | ||||||||||||||||||||||||||||
| Updated: | 2013-05-15 | ||||||||||||||||||||||||||||
| Summary: | The XML libraries for Python 3.4, 3.3, 3.2, 3.1, 2.7, and 2.6, as used in OpenStack Keystone Essex, Folsom, and Grizzly; Compute (Nova) Essex and Folsom; Cinder Folsom; Django; and possibly other products allow remote attackers to cause a denial of service (resource consumption and crash) via an XML Entity Expansion (XEE) attack. | ||||||||||||||||||||||||||||
| CVSS v3 Severity: | 5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
| ||||||||||||||||||||||||||||
| CVSS v2 Severity: | 5.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P) 3.7 Low (Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P/E:U/RL:OF/RC:C)
3.7 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P/E:U/RL:OF/RC:C)
| ||||||||||||||||||||||||||||
| Vulnerability Type: | CWE-119 | ||||||||||||||||||||||||||||
| Vulnerability Consequences: | Denial of Service | ||||||||||||||||||||||||||||
| References: | Source: CONFIRM Type: UNKNOWN http://blog.python.org/2013/02/announcing-defusedxml-fixes-for-xml.html Source: CONFIRM Type: UNKNOWN http://bugs.python.org/issue17239 Source: MITRE Type: CNA CVE-2013-1664 Source: CCN Type: OpenStack Security Advisory: 2013-004 Information leak and Denial of Service using XML entities Source: MLIST Type: Vendor Advisory [openstack-announce] 20130219 [OSSA 2013-004] Information leak and Denial of Service using XML entities (CVE-2013-1664, CVE-2013-1665) Source: REDHAT Type: UNKNOWN RHSA-2013:0657 Source: REDHAT Type: UNKNOWN RHSA-2013:0658 Source: REDHAT Type: UNKNOWN RHSA-2013:0670 Source: CCN Type: SA52224 OpenStack Keystone and Compute (Nova) Two Vulnerabilities Source: CCN Type: SA52243 Django Multiple Vulnerabilities Source: UBUNTU Type: UNKNOWN USN-1757-1 Source: MLIST Type: UNKNOWN [oss-security] 20130219 [OSSA 2013-004] Information leak and Denial of Service using XML entities (CVE-2013-1664, CVE-2013-1665) Source: MLIST Type: UNKNOWN [oss-security] 20130219 REJECT CVE-2013-0278, CVE-2013-0279 and CVE-2013-0280 Source: CCN Type: BID-58022 Multiple OpenStack Products CVE-2013-1665 XML External Entity Information Disclosure Vulnerability Source: CCN Type: BID-58061 Django Formsets Denial of Service Vulnerability Source: CCN Type: BID-58892 Multiple OpenStack Products CVE-2013-1664 Denial of Service Vulnerability Source: CONFIRM Type: Exploit https://bugs.launchpad.net/nova/+bug/1100282 Source: XF Type: UNKNOWN django-keystone-xml-dos(82202) Source: CCN Type: Django Web site Security releases issued | ||||||||||||||||||||||||||||
| Vulnerable Configuration: | Configuration 1: Configuration CCN 1:  Denotes that component is vulnerable | ||||||||||||||||||||||||||||
| Oval Definitions | |||||||||||||||||||||||||||||
| |||||||||||||||||||||||||||||
| BACK | |||||||||||||||||||||||||||||