Unscored severity · published Apr 3, 2013
CVE-2013-1665
The XML libraries for Python 3.4, 3.3, 3.2, 3.1, 2.7, and 2.6, as used in OpenStack Keystone Essex and Folsom, Django, and possibly other products allow remote attackers to read…
–
CVSS
4.5%
EPSS
No
On KEV
Description
The XML libraries for Python 3.4, 3.3, 3.2, 3.1, 2.7, and 2.6, as used in OpenStack Keystone Essex and Folsom, Django, and possibly other products allow remote attackers to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, aka an XML External Entity (XXE) attack.
Exploitation
Is it being used?
Exploit prediction (EPSS)4.5% · higher than 91% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FO
Folsom · Openstack
All versions, or not specified · source: NVD
KE
Keystone Essex · Openstack
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-1665
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-1665
blog.python.org
http://blog.python.org/2013/02/announcing-defusedxml-fixes-for-xml.html
bugs.python.org
http://bugs.python.org/issue17239
Vendor Advisory
http://lists.openstack.org/pipermail/openstack-announce/2013-February/000078.html
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2013-0657.html
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2013-0658.html
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2013-0670.html
More from Folsom
8.8
CVE-2013-0261
A flaw was found in PackStack
7.6
CVE-2013-0335
OpenStack Compute (Nova) Grizzly, Folsom (2012.2), and Essex (2012.1) allows remote authenticated users to gain access to a VM in opportunistic circumstances by using the VNC…
5.5
CVE-2013-0266
A flaw was found in the `puppetlabs-cinder` module, as used in PackStack
5.4
CVE-2012-5571
A flaw was found in OpenStack Keystone
–
CVE-2013-4463
OpenStack Compute (Nova) Folsom, Grizzly, and Havana does not properly verify the virtual size of a QCOW2 image, which allows local users to cause a denial of service (host file…