VDB
KO
MEDIUM

GHSA-x64m-686f-fmm3

XML External Entity (XXE) in Django

Details

The XML libraries for Python as used in OpenStack Keystone Essex and Folsom, Django, and possibly other products allow remote attackers to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, aka an XML External Entity (XXE) attack.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI / django
Introduced in: 1.3.0 Fixed in: 1.3.6
Fix pip install --upgrade 'django>=1.3.6'
PyPI / django
Introduced in: 1.4.0 Fixed in: 1.4.4
Fix pip install --upgrade 'django>=1.4.4'

References