Permalink
Browse files

[1.4.x] Don't characterize XML vulnerabilities as DoS-only.

  • Loading branch information...
1 parent f61f800 commit 5d1791ffd2ffdb70cbcf81a49cb0a7cda3fe1f46 @carljm carljm committed Feb 20, 2013
Showing with 5 additions and 6 deletions.
  1. +5 −6 docs/releases/1.4.4.txt
@@ -40,12 +40,11 @@ XML deserialization
-------------------
The XML parser in the Python standard library is vulnerable to a number of
-denial-of-service attacks via external entities and entity expansion. Django
-uses this parser for deserializing XML-formatted database fixtures. This
-deserializer is not intended for use with untrusted data, but in order to err
-on the side of safety in Django 1.4.4 the XML deserializer refuses to parse an
-XML document with a DTD (DOCTYPE definition), which closes off these attack
-avenues.
+attacks via external entities and entity expansion. Django uses this parser for
+deserializing XML-formatted database fixtures. This deserializer is not
+intended for use with untrusted data, but in order to err on the side of safety
+in Django 1.4.4 the XML deserializer refuses to parse an XML document with a
+DTD (DOCTYPE definition), which closes off these attack avenues.
These issues in the Python standard library are CVE-2013-1664 and
CVE-2013-1665. More information available `from the Python security team`_.

0 comments on commit 5d1791f

Please sign in to comment.