CVE-2013-1664

描述

The XML libraries for Python 3.4, 3.3, 3.2, 3.1, 2.7, and 2.6, as used in OpenStack Keystone Essex, Folsom, and Grizzly; Compute (Nova) Essex and Folsom; Cinder Folsom; Django; and possibly other products allow remote attackers to cause a denial of service (resource consumption and crash) via an XML Entity Expansion (XEE) attack.

如何修補 CVE-2013-1664

要修補 CVE-2013-1664,請將受影響套件升級到下列已修補版本。

• PyPI/django—升級至 1.3.6 或更新版本
• PyPI/django—升級至 1.3.6 或更新版本

CVE-2013-1664 正在被利用嗎?

低 — EPSS 為 4.9%,目前沒有觀察到大規模利用活動。

受影響套件(2)

• >= 1.3.0, < 1.3.6
• >= 1.3.0, < 1.3.6, >= 1.4.0, < 1.4.4

參考連結(16)

• ADVISORYgithub.com/advisories/GHSA-qrh7-x6fp-c2mp
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2013-1664
• PATCHgithub.com/django/django
• PATCHpypi.org/project/django
• WEBblog.python.org