CVE-2013-1664

2013-04-0300:55:00

CWE-119

[email protected]

web.nvd.nist.gov

cve-2013-1664

xml libraries

python

openstack

keystone

xee attack

nvd

8.9 High

AI Score

Confidence

High

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.09 Low

EPSS

Percentile

94.6%

JSON

The XML libraries for Python 3.4, 3.3, 3.2, 3.1, 2.7, and 2.6, as used in OpenStack Keystone Essex, Folsom, and Grizzly; Compute (Nova) Essex and Folsom; Cinder Folsom; Django; and possibly other products allow remote attackers to cause a denial of service (resource consumption and crash) via an XML Entity Expansion (XEE) attack.

CPENameOperatorVersion
openstack:cinder_folsomopenstack cinder folsomeq-
openstack:keystone_essexopenstack keystone essexeq-
openstack:grizzlyopenstack grizzlyeq-
openstack:folsomopenstack folsomeq-
openstack:compute_\(nova\)_essexopenstack compute \(nova\) essexeq-
openstack:compute_\(nova\)_folsomopenstack compute \(nova\) folsomeq-

CPE	Name	Operator	Version
openstack:cinder_folsom	openstack cinder folsom	eq	-
openstack:keystone_essex	openstack keystone essex	eq	-
openstack:grizzly	openstack grizzly	eq	-
openstack:folsom	openstack folsom	eq	-
openstack:compute_\(nova\)_essex	openstack compute \(nova\) essex	eq	-
openstack:compute_\(nova\)_folsom	openstack compute \(nova\) folsom	eq	-