XML Entity Expansion (XEE) in Django
Date: 2022-05
Affected: pip/Django, pip/Django
Attack vector: dos
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2013-1664
CVE-2013-1665
CWE: CWE-200
CWE-611

The XML libraries for Python, as used in OpenStack Keystone Essex, Folsom, and Grizzly; Compute (Nova) Essex and Folsom; Cinder Folsom; Django; and possibly other products allow remote attackers to cause a denial of service (resource consumption and crash) via an XML Entity Expansion (XEE) attack.


Mitigations:

Architectural layers (MAESTRO):