Browse files

[1.3.x] Don't characterize XML vulnerabilities as DoS-only.

  • Loading branch information...
1 parent 747d3f0 commit 2378c31430a2b441d23efe98c0af32fe4af0fb53 @carljm carljm committed Feb 19, 2013
Showing with 5 additions and 6 deletions.
  1. +5 −6 docs/releases/1.3.6.txt
View
11 docs/releases/1.3.6.txt
@@ -39,12 +39,11 @@ XML deserialization
-------------------
The XML parser in the Python standard library is vulnerable to a number of
-denial-of-service attacks via external entities and entity expansion. Django
-uses this parser for deserializing XML-formatted database fixtures. The fixture
-deserializer is not intended for use with untrusted data, but in order to err
-on the side of safety in Django 1.3.6 the XML deserializer refuses to parse an
-XML document with a DTD (DOCTYPE definition), which closes off these attack
-avenues.
+attacks via external entities and entity expansion. Django uses this parser for
+deserializing XML-formatted database fixtures. The fixture deserializer is not
+intended for use with untrusted data, but in order to err on the side of safety
+in Django 1.3.6 the XML deserializer refuses to parse an XML document with a
+DTD (DOCTYPE definition), which closes off these attack avenues.
These issues in the Python standard library are CVE-2013-1664 and
CVE-2013-1665. More information available `from the Python security team`_.

0 comments on commit 2378c31

Please sign in to comment.