Moderate severityNVD Advisory· Published Apr 3, 2013· Updated Jun 16, 2026
CVE-2013-1665
CVE-2013-1665
Description
The XML libraries for Python 3.4, 3.3, 3.2, 3.1, 2.7, and 2.6, as used in OpenStack Keystone Essex and Folsom, Django, and possibly other products allow remote attackers to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, aka an XML External Entity (XXE) attack.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
DjangoPyPI | >= 1.3.0, < 1.3.6 | 1.3.6 |
DjangoPyPI | >= 1.4.0, < 1.4.4 | 1.4.4 |
Affected products
3Patches
Vulnerability mechanics
References
15- bugs.launchpad.net/keystone/+bug/1100279nvdPatchWEB
- lists.openstack.org/pipermail/openstack-announce/2013-February/000078.htmlnvdVendor AdvisoryWEB
- github.com/advisories/GHSA-x64m-686f-fmm3ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2013-1665ghsaADVISORY
- blog.python.org/2013/02/announcing-defusedxml-fixes-for-xml.htmlnvdWEB
- bugs.python.org/issue17239nvdWEB
- rhn.redhat.com/errata/RHSA-2013-0657.htmlnvdWEB
- rhn.redhat.com/errata/RHSA-2013-0658.htmlnvdWEB
- rhn.redhat.com/errata/RHSA-2013-0670.htmlnvdWEB
- ubuntu.com/usn/usn-1757-1nvdWEB
- www.debian.org/security/2013/dsa-2634nvdWEB
- www.openwall.com/lists/oss-security/2013/02/19/2nvdWEB
- www.openwall.com/lists/oss-security/2013/02/19/4nvdWEB
- github.com/django/django/commit/1c60d07ba23e0350351c278ad28d0bd5aa410b40ghsaWEB
- github.com/django/django/commit/d19a27066b2247102e65412aa66917aff0091112ghsaWEB
News mentions
0No linked articles in our index yet.