Skip to content
OpenAdvisories
Medium RHSA-2013:0670 4 CVEs

Red Hat Security Advisory: Django security update

Published Sep 15, 2024 · Updated Aug 1, 2026

Ecosystem: Red Hat

Fixed packages 2

ReleasePackageFixed in
Red Hat · OpenStack 2 openstack:2::el6 Django14 0:1.4.4-1.el6ost
Red Hat · OpenStack 2 openstack:2::el6 Django14-doc 0:1.4.4-1.el6ost

Vulnerabilities 4

  • Medium 5.3
    CVE-2013-0306

    Django is vulnerable to Denial of Service attack in formset

    The form library in Django 1.3.x before 1.3.6, 1.4.x before 1.4.4, and 1.5 before release candidate 2 allows remote attackers to bypass intended resource limits for formsets and cause a denial of service (memory consumption) or trigger server errors via a mod…

    python-django django Debian PyPI
  • Medium 4.3
    CVE-2013-0305

    Django Data leakage via admin history log

    The administrative interface for Django 1.3.x before 1.3.6, 1.4.x before 1.4.4, and 1.5 before release candidate 2 does not check permissions for the history view, which allows remote authenticated administrators to obtain sensitive object history information.

    python-django django Debian PyPI
  • Medium —
    CVE-2013-1664

    XML Entity Expansion (XEE) in Django

    The XML libraries for Python 3.4, 3.3, 3.2, 3.1, 2.7, and 2.6, as used in OpenStack Keystone Essex, Folsom, and Grizzly; Compute (Nova) Essex and Folsom; Cinder Folsom; Django; and possibly other products allow remote attackers to cause a denial of service (r…

    django nova keystone cinder Debian PyPI
  • Medium —
    CVE-2013-1665

    XML External Entity (XXE) in Django

    The XML libraries for Python 3.4, 3.3, 3.2, 3.1, 2.7, and 2.6, as used in OpenStack Keystone Essex and Folsom, Django, and possibly other products allow remote attackers to read arbitrary files via an XML external entity declaration in conjunction with an ent…

    python-django django keystone Debian PyPI

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=912982
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=913037
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=913039
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=913041
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=913042
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=913808
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_0670.json
  • report
    https://access.redhat.com/security/cve/CVE-2013-0305
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2013-0305
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2013-0305
  • report
    https://access.redhat.com/security/cve/CVE-2013-0306
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2013-0306
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2013-0306
  • report
    https://access.redhat.com/security/cve/CVE-2013-1664
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2013-1664
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2013-1664
  • report
    https://access.redhat.com/security/cve/CVE-2013-1665
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2013-1665
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2013-1665