Jonathan Murray

**Name of the Vulnerable Software and Affected Versions** Python versions 3.4, 3.3, 3.2, 3.1, 2.7, and 2.6 libxml2 versions prior to 2.9.1-r1 **Description** The issue allows remote attackers to cause a denial of service, resulting in resource consumption and crash, via an XML Entity Expansion (XEE) attack. This can lead to disruption of confidentiality, integrity, and availability of protected information. The estimated number of potentially affected devices worldwide is not available. There is no information about real-world incidents where this issue was exploited. **Recommendations** For Python versions 3.4, 3.3, 3.2, 3.1, 2.7, and 2.6, consider disabling the XML libraries as a temporary workaround until a patch is available. For libxml2 versions prior to 2.9.1-r1, update to version 2.9.1-r1 or later to resolve the issue. As a general mitigation measure, restrict access to the XML libraries to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Python versions 3.4, 3.3, 3.2, 3.1, 2.7, and 2.6 **Description** The issue allows remote attackers to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, also known as an XML External Entity (XXE) attack. This affects products using the XML libraries for Python, including OpenStack Keystone Essex and Folsom, and Django. **Recommendations** For Python versions 3.4, 3.3, 3.2, 3.1, 2.7, and 2.6, consider disabling the XML external entity processing to prevent XXE attacks until a patch is available. Restrict access to sensitive files and directories to minimize the risk of exploitation. Avoid using XML libraries that do not properly validate external entity declarations. At the moment, there is no information about a newer version that contains a fix for this vulnerability.