CVE-2022-48564: Medium severity Python Python vulnerability
Last updated 24 July 2024
Other sources
Python is vulnerable to a denial of service, caused by a flaw in the readints function in plistlib.py. By persuading a victim to open a specially crafted Apple Property List file file, a remote attacker could exploit this vulnerability to cause CPU and RAM exhaustion, and results in a denial of service condition.
— IBM
readints in plistlib.py in Python through 3.9.1 is vulnerable to a potential DoS attack via CPU and RAM exhaustion when processing malformed Apple Property List files in binary format.
— Launchpad
The Python's readints() in plistlib.py is vulnerable to a potential DoS attack via CPU and RAM exhaustion when processing malformed Apple Property List files in binary format.
https://bugs.python.org/issue42103 https://github.com/python/cpython/issues/86269 https://github.com/python/cpython/commit/34637a0ce21e7261b952fbd9d006474cc29b681f (v3.10.0a2) https://github.com/python/cpython/commit/e277cb76989958fdbc092bf0b2cb55c43e86610a (v3.9.1rc1) https://github.com/python/cpython/commit/547d2bcc55e348043b2f338027c1acd9549ada76 (v3.8.7rc1) https://github.com/python/cpython/commit/225e3659556616ad70186e7efc02baeebfeb5ec4 (v3.7.10) https://github.com/python/cpython/commit/a63234c49b2fbfb6f0aca32525e525ce3d43b2b4 (v3.6.13)
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/pythonto a version that resolves this vulnerability.Fixed in 3.10.0 - Upgrade
Upgrade
redhat/pythonto a version that resolves this vulnerability.Fixed in 3.9.1 - Upgrade
Upgrade
redhat/pythonto a version that resolves this vulnerability.Fixed in 3.8.7 - Upgrade
Upgrade
redhat/pythonto a version that resolves this vulnerability.Fixed in 3.7.10 - Upgrade
Upgrade
redhat/pythonto a version that resolves this vulnerability.Fixed in 3.6.13 - Upgrade
Upgrade
debian/pypy3to a version that resolves this vulnerability.Fixed in 7.3.5+dfsg-2+deb11u2Fixed in 7.3.5+dfsg-2+deb11u4Fixed in 7.3.11+dfsg-2+deb12u3Fixed in 7.3.19+dfsg-1 - Upgrade
Upgrade
debian/python2.7to a version that resolves this vulnerability.Fixed in 2.7.18-8+deb11u1 - Upgrade
Upgrade
debian/python3.9to a version that resolves this vulnerability.Fixed in 3.9.2-1Fixed in 3.9.2-1+deb11u3 - Upgrade
Upgrade
Pythonto a version that resolves this vulnerability.Fixed in 3.6.13 - Upgrade
Upgrade
Pythonto a version that resolves this vulnerability.Fixed in 3.7.10 - Upgrade
Upgrade
Pythonto a version that resolves this vulnerability.Fixed in 3.8.7rc1 - Upgrade
Upgrade
Pythonto a version that resolves this vulnerability.Fixed in 3.9.1rc1 - Upgrade
Upgrade
Pythonto a version that resolves this vulnerability.Fixed in 3.10.0a2
Event History
Frequently Asked Questions
What is CVE-2022-48564?
CVE-2022-48564 is a vulnerability in Python through 3.9.1 that can lead to a potential denial-of-service (DoS) attack via CPU and RAM exhaustion when processing malformed Apple Property List files in binary format.
How does CVE-2022-48564 affect Python?
CVE-2022-48564 affects Python versions up to and including 3.9.1.
What is the severity level of CVE-2022-48564?
The severity level of CVE-2022-48564 is medium with a CVSS score of 6.5.
How can I mitigate the impact of CVE-2022-48564?
To mitigate the impact of CVE-2022-48564, it is recommended to update Python to version 3.9.2 or later.
Where can I find more information about CVE-2022-48564?
More information about CVE-2022-48564 can be found at the following references: [Link 1](https://bugs.python.org/issue42103), [Link 2](https://security.netapp.com/advisory/ntap-20230929-0009/).