Red Hat Security Advisory: openstack-cinder security and enhancement update

Fixed packages 3

Vulnerabilities 2

• Medium —
  CVE-2013-1664

  XML Entity Expansion (XEE) in Django

  The XML libraries for Python 3.4, 3.3, 3.2, 3.1, 2.7, and 2.6, as used in OpenStack Keystone Essex, Folsom, and Grizzly; Compute (Nova) Essex and Folsom; Cinder Folsom; Django; and possibly other products allow remote attackers to cause a denial of service (r…

  django nova keystone cinder Debian PyPI
  Apr 3, 2013
• Medium —
  CVE-2013-1665

  XML External Entity (XXE) in Django

  The XML libraries for Python 3.4, 3.3, 3.2, 3.1, 2.7, and 2.6, as used in OpenStack Keystone Essex and Folsom, Django, and possibly other products allow remote attackers to read arbitrary files via an XML external entity declaration in conjunction with an ent…

  python-django django keystone Debian PyPI
  Apr 3, 2013

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• article
  https://rhn.redhat.com/errata/RHSA-2013-0657.html
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=892686
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=910222
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=912982
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=913808
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_0658.json
• report
  https://access.redhat.com/security/cve/CVE-2013-1664
• advisory
  https://www.cve.org/CVERecord?id=CVE-2013-1664
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2013-1664
• report
  https://access.redhat.com/security/cve/CVE-2013-1665
• advisory
  https://www.cve.org/CVERecord?id=CVE-2013-1665
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2013-1665