Description
The XML libraries for Python 3.4, 3.3, 3.2, 3.1, 2.7, and 2.6, as used in OpenStack Keystone Essex and Folsom, Django, and possibly other products allow remote attackers to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, aka an XML External Entity (XXE) attack.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | keystone | 2012.1.1-13 | — |
| Debian 14 | python-django | 1.4.4-1 | — |
| Debian 13 | keystone | 2012.1.1-13 | — |
| Debian 13 | python-django | 1.4.4-1 | — |
| Debian 12 | keystone | 2012.1.1-13 | — |
| Debian 12 | python-django | 1.4.4-1 | — |
| Debian 6.0 | python-django | 1.2.3-3+squeeze5 | DSA-2634-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenStack 2 | Django14 +1 | 1.4.4-1.el6ost | RHSA-2013:0670 |
| Red Hat OpenStack 2 | python-keystone +2 | 2012.2.3-3.el6ost | RHSA-2013:0596 |
| Red Hat OpenStack 2 | python-nova +14 | 2012.2.3-4.el6ost | RHSA-2013:0658, RHSA-2013:0657 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | django | >= 1.3.0, < 1.3.6 | 1.3.6 | GHSA-x64m-686f-fmm3 |
| PyPI | django | >= 1.4.0, < 1.4.4 | 1.4.4 | GHSA-x64m-686f-fmm3 |
| PyPI | django | >= 1.3.0, < 1.3.6 · >= 1.4.0, < 1.4.4 | 1.3.6, 1.4.4 | PYSEC-2026-802 |
Advisories 5
- RHSA-2013:0596 Red Hat Security Advisory: openstack-keystone security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Aug 8, 2026
- RHSA-2013:0657 Red Hat Security Advisory: openstack-nova security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Aug 1, 2026
- RHSA-2013:0658 Red Hat Security Advisory: openstack-cinder security and enhancement update Red Hat Security Advisories (RHSA) · Aug 1, 2026
- RHSA-2013:0670 Red Hat Security Advisory: Django security update Red Hat Security Advisories (RHSA) · Aug 1, 2026
- DSA-2634-1 python-django - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
References
- [oss-security] 20130219 REJECT CVE-2013-0278, CVE-2013-0279 and CVE-2013-0280 mailing-list
- [openstack-announce] 20130219 [OSSA 2013-004] Information leak and Denial of Service using XML entities (CVE-2013-1664, CVE-2013-1665) mailing-list
- RHSA-2013:0658 vendor-advisory
- [oss-security] 20130219 [OSSA 2013-004] Information leak and Denial of Service using XML entities (CVE-2013-1664, CVE-2013-1665) mailing-list
- USN-1757-1 vendor-advisory
- RHSA-2013:0657 vendor-advisory
- DSA-2634 vendor-advisory
- http://blog.python.org/2013/02/announcing-defusedxml-fixes-for-xml.html
- RHSA-2013:0670 vendor-advisory
- http://bugs.python.org/issue17239
- https://bugs.launchpad.net/keystone/+bug/1100279