CVE-2022-48565

CRITICAL severity · CVSS 9.8 · XML external entity (XXE)

9.8CVSS CRITICAL

Summary

An XML External Entity (XXE) issue was discovered in Python through 3.9.1. The plistlib module no longer accepts entity declarations in XML plist files to avoid XML vulnerabilities.

Impact & exploitability

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionNone

Confidentiality impactHigh

Integrity impactHigh

Availability impactHigh

Exploit probability (EPSS)7%

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products we track (1)

Python

Recommendation

Apply the vendor fix promptly. Open any affected product above for its exact safe version.

Official patch: https://bugs.python.org/issue42051 ↗

Additional information

NVD record
https://bugs.python.org/issue42051Patch
https://bugs.python.org/issue42051Patch
https://lists.debian.org/debian-lts-announce/2023/09/msg00022.htmlAdvisory
https://lists.debian.org/debian-lts-announce/2023/10/msg00017.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AFHYAGWBFBNUGWU6XWKBHTCV5NH77MB7/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BAYWJD576JUKLHCWKDLMJSUGTRDKPF3M/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KZRZRJHWLZ7MOJNPQBWGJVXMVYDC5BRA/
https://security.netapp.com/advisory/ntap-20231006-0007/