Skip to content

HTTPS clone URL

Subversion checkout URL

You can clone with HTTPS or Subversion.

Download ZIP
Browse files

[1.4.x] Don't characterize XML vulnerabilities as DoS-only.

  • Loading branch information...
commit 5d1791ffd2ffdb70cbcf81a49cb0a7cda3fe1f46 1 parent f61f800
@carljm carljm authored
Showing with 5 additions and 6 deletions.
  1. +5 −6 docs/releases/1.4.4.txt
View
11 docs/releases/1.4.4.txt
@@ -40,12 +40,11 @@ XML deserialization
-------------------
The XML parser in the Python standard library is vulnerable to a number of
-denial-of-service attacks via external entities and entity expansion. Django
-uses this parser for deserializing XML-formatted database fixtures. This
-deserializer is not intended for use with untrusted data, but in order to err
-on the side of safety in Django 1.4.4 the XML deserializer refuses to parse an
-XML document with a DTD (DOCTYPE definition), which closes off these attack
-avenues.
+attacks via external entities and entity expansion. Django uses this parser for
+deserializing XML-formatted database fixtures. This deserializer is not
+intended for use with untrusted data, but in order to err on the side of safety
+in Django 1.4.4 the XML deserializer refuses to parse an XML document with a
+DTD (DOCTYPE definition), which closes off these attack avenues.
These issues in the Python standard library are CVE-2013-1664 and
CVE-2013-1665. More information available `from the Python security team`_.
Please sign in to comment.
Something went wrong with that request. Please try again.