CVE-2013-1665: The XML libraries for Python 3.4, 3.3, 3.2, 3.1, 2.7, and 2.6, as used in OpenStack Keystone Essex and Fols...

Security readout for executives and security teams

CVE-2013-1665 is an XML External Entity issue in Python XML libraries used by Python 2.6, 2.7, and 3.1 through 3.4. If an application accepts attacker-controlled XML, a remote attacker may cause the service to read local files. OpenStack Keystone Essex and Folsom, Django, and possibly other products were cited as affected contexts. Exposure is most likely in legacy Python services or frameworks that parse XML supplied by users, integrations, APIs, identity systems, or message feeds. The source bundle names OpenStack Keystone Essex/Folsom and Django, but affected deployment scope depends on whether vulnerable Python XML parsing is reachable with untrusted XML. Treat as high priority for legacy internet-facing or identity-related systems that parse XML. The issue can expose sensitive local files, including configuration or credential material, but urgency is lower where vulnerable Python versions are retired or XML parsing is not reachable by untrusted users. Mitigation focus: Apply relevant vendor updates from Python, OpenStack, Red Hat, Ubuntu, or Debian guidance.; Replace unsafe Python XML parsing with defusedxml where vendor guidance supports it.; Disable external entity resolution in XML parsers that handle untrusted input..

Prepared

Jun 24, 2026, 11:46 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.