CVEvulnerability
CVE-2022-48565
9.8 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2023-08-22
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-611
Description
An XML External Entity (XXE) issue was discovered in Python through 3.9.1. The plistlib module no longer accepts entity declarations in XML plist files to avoid XML vulnerabilities.
Affected configurations
• python python (< 3.6.13)
• python python (>= 3.7.0 < 3.7.10)
• python python (>= 3.8.0 < 3.8.7)
• python python (>= 3.9.0 < 3.9.1)
• debian debian linux 10.0
Related
Weakness · CWE (1)
- CWE-611 Improper Restriction of XML External Entity Reference weakness
References
- https://bugs.python.org/issue42051 Exploit, Issue Tracking, Patch, Vendor Advisory
- https://lists.debian.org/debian-lts-announce/2023/09/msg00022.html Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2023/10/msg00017.html lists.debian.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AFHYAGWBFBNUGWU6XWKBHTCV5NH77MB7/ lists.fedoraproject.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BAYWJD576JUKLHCWKDLMJSUGTRDKPF3M/ lists.fedoraproject.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KZRZRJHWLZ7MOJNPQBWGJVXMVYDC5BRA/ lists.fedoraproject.org
- https://security.netapp.com/advisory/ntap-20231006-0007/ security.netapp.com
- https://bugs.python.org/issue42051 Exploit, Issue Tracking, Patch, Vendor Advisory
- https://lists.debian.org/debian-lts-announce/2023/09/msg00022.html Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2023/10/msg00017.html lists.debian.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AFHYAGWBFBNUGWU6XWKBHTCV5NH77MB7/ lists.fedoraproject.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BAYWJD576JUKLHCWKDLMJSUGTRDKPF3M/ lists.fedoraproject.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KZRZRJHWLZ7MOJNPQBWGJVXMVYDC5BRA/ lists.fedoraproject.org
- https://security.netapp.com/advisory/ntap-20231006-0007/ security.netapp.com