CVE-2013-1753: 
Python vulnerability analysis and mitigation

The vulnerability (CVE-2013-1753) affects the gzip_decode function in the xmlrpc client library in Python 3.4 and earlier versions. Discovered and disclosed in February 2013, this vulnerability allows remote attackers to cause a denial of service through memory consumption by sending crafted HTTP requests (MITRE CVE, NVD).

The vulnerability exists in the xmlrpc client library's gzip decompression handler for compressed HTTP streams. The gzip_decode() function, which decompresses HTTP bodies sent with Accept-Encoding: x-gzip, had no limitation on the amount of data it could decompress. For example, less than 1 MB of compressed gzip data could expand to 1 GB of null bytes when decompressed (Python Bug).

When exploited, this vulnerability can lead to significant memory consumption on the target system, potentially causing a denial of service condition. The impact is particularly severe as a small amount of compressed data can be used to consume a disproportionately large amount of memory on the target system (Python Bug).

The issue was fixed by adding a default limit for the amount of data xmlrpclib.gzip_decode will return. Updates were released for various Python versions including 2.7.9-1, 3.4.2-4, and other maintained versions. Users are advised to upgrade to the patched versions (Python Bug, Debian Tracker).