Read the docs
TI-2013-01462 Aliases CVE-2013-1665GHSA-x64m-686f-fmm3

The XML libraries for Python 3.4, 3.3, 3.2, 3.1, 2.7, and 2.6, as used in OpenStack…

Priority LOW 30CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
Partial · None · None
Fix status
Partial Red Hat: 1 fixed, 3 without a fix

Attack profile from CVSS 2.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-200.

Summary

The XML libraries for Python 3.4, 3.3, 3.2, 3.1, 2.7, and 2.6, as used in OpenStack Keystone Essex and Folsom, Django, and possibly other products allow remote attackers to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, aka an XML External Entity (XXE) attack.

Why it matters now

EPSS 0.04507 91st percentileScored 2026-11-07
Fix Partial Django (PyPI): 1.3.6, 1.4.4Red Hat: 4 advisoriesRed Hat: 1 fixed, 3 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—Django (PyPI)1.3.0 to before 1.3.61.3.6Patch availableGHSA-x64m-686f-fmm3
—Django (PyPI)1.4.0 to before 1.4.41.4.4Patch availableGHSA-x64m-686f-fmm3
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • Django (PyPI) Vendor— Affected 1.3.0 to before 1.3.6 Fixed in 1.3.6 Patch available GHSA-x64m-686f-fmm3
  • Django (PyPI) Vendor— Affected 1.4.0 to before 1.4.4 Fixed in 1.4.4 Patch available GHSA-x64m-686f-fmm3

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:openstack:folsom:-:*:*:*:*:*:*:*not specified by NVDVulnerableOpenStack
cpe:2.3:a:openstack:keystone_essex:-:*:*:*:*:*:*:*not specified by NVDVulnerableOpenStack
  • cpe:2.3:a:openstack:folsom:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·OpenStack
  • cpe:2.3:a:openstack:keystone_essex:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·OpenStack

Remediation

  • Fix · GHSA-x64m-686f-fmm3 Django (PyPI) Fixed in 1.3.6 Advisory →
  • Fix · GHSA-x64m-686f-fmm3 Django (PyPI) Fixed in 1.4.4 Advisory →

Red Hat 4 advisories

  • RHSA-2013:0670 Released 2013-03-21 · Red Hat rating Moderate
    Django security update
    • OpenStack Folsom Django14-1.4.4-1.el6ost, Django14-doc-1.4.4-1.el6ost
  • RHSA-2013:0658 Released 2013-03-21 · Red Hat rating Moderate
    openstack-cinder security and enhancement update
    • OpenStack Folsom openstack-cinder-2012.2.3-4.el6ost, openstack-cinder-doc-2012.2.3-4.el6ost, python-cinder-2012.2.3-4.el6ost
  • RHSA-2013:0657 Released 2013-03-21 · Red Hat rating Moderate
    openstack-nova security, bug fix, and enhancement update
    • OpenStack Folsom openstack-nova-2012.2.3-4.el6ost, openstack-nova-api-2012.2.3-4.el6ost, openstack-nova-cert-2012.2.3-4.el6ost +9
Show 1 more Red Hat advisories
  • RHSA-2013:0596 Released 2013-03-05 · Red Hat rating Moderate
    openstack-keystone security, bug fix, and enhancement update
    • OpenStack Folsom openstack-keystone-2012.2.3-3.el6ost, openstack-keystone-doc-2012.2.3-3.el6ost, python-keystone-2012.2.3-3.el6ost

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 5AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux 7AffectedNo fix planned: Will not fix
OpenStack FolsomFixed RHSA-2013:0596, RHSA-2013:0657, RHSA-2013:0658, RHSA-2013:0670

Timeline

  1. 2026-10-02 Threatist record created from CVE-2013-1665
  2. 2026-10-03 Alias added: GHSA-x64m-686f-fmm3

References

Patch 1

Advisory 7

Other 6

  • TI-2013-00195 Packstack: packstack: arbitrary file overwrite via symlink attack CVSS 3.1HIGH 8.8
  • TI-2013-01930 XML injection vulnerability in account/utils.py in OpenStack Swift Folsom, Grizzly, and… CVSS 2.0HIGH 7.5
  • TI-2013-00265 Openstack nova: vnc proxy can connect to the wrong vm CVSS 3.1HIGH 7.6
  • TI-2013-01648 OpenStack Keystone Folsom (2012.2) does not properly perform revocation checks for… CVSS 2.0MEDIUM 6.8
  • TI-2013-00142 The boot-from-volume feature in OpenStack Compute (Nova) Folsom and Essex, when using… CVSS 2.0MEDIUM 6.5
  • TI-2013-03945 The XenAPI backend in OpenStack Compute (Nova) Folsom, Grizzly, and Havana before 2013.2… CVSS 2.0MEDIUM 6.4
See all 24 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences