CVE-2013-1753
python: XMLRPC library unrestricted decompression of HTTP responses using gzip enconding
Severity
ModerateRed Hat Product Security
CVSS 2.0
Review impact separately from score.
Published · September 25, 2012
Updated · August 5, 2026
Description
It was discovered that the Python xmlrpclib did not restrict the size of a gzip compressed HTTP responses. A malicious XMLRPC server could cause an XMLRPC client using xmlrpclib to consume an excessive amount of memory.
Statement
This issue did not affect the versions of python as shipped with Red Hat Enterprise Linux 5 and 6 as their XMLRPC library did not include support for gzip encoded content.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 2.0 · 4.3AV:N/AC:M/Au:N/C:N/I:N/A:P
CWE-400 · Uncontrolled Resource Consumption