CVE-2022-48565: XEE
An XML External Entity (XXE) issue was discovered in Python through 3.9.1. The plistlib module no longer accepts entity declarations in XML plist files to avoid XML vulnerabilities.
Other sources
Python could allow a local authenticated attacker to obtain sensitive information, caused by improper handling of XML external entity (XXE) declarations by the plistlib module. By using a specially crafted XML content, a remote attacker could exploit this vulnerability to obtain sensitive information, and use this information to launch further attacks against the affected system.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/pythonto a version that resolves this vulnerability.Fixed in 3.10.0 - Upgrade
Upgrade
redhat/pythonto a version that resolves this vulnerability.Fixed in 3.9.1 - Upgrade
Upgrade
redhat/pythonto a version that resolves this vulnerability.Fixed in 3.8.7 - Upgrade
Upgrade
redhat/pythonto a version that resolves this vulnerability.Fixed in 3.7.10 - Upgrade
Upgrade
redhat/pythonto a version that resolves this vulnerability.Fixed in 3.6.13 - Upgrade
Upgrade
debian/pypy3to a version that resolves this vulnerability.Fixed in 7.3.5+dfsg-2+deb11u2Fixed in 7.3.5+dfsg-2+deb11u4Fixed in 7.3.11+dfsg-2+deb12u3Fixed in 7.3.19+dfsg-1 - Upgrade
Upgrade
debian/python2.7to a version that resolves this vulnerability.Fixed in 2.7.18-8+deb11u1 - Upgrade
Upgrade
debian/python3.9to a version that resolves this vulnerability.Fixed in 3.9.2-1Fixed in 3.9.2-1+deb11u3
Event History
Frequently Asked Questions
What is CVE-2022-48565?
CVE-2022-48565 is an XML External Entity (XXE) issue in Python through 3.9.1.
What is the severity of CVE-2022-48565?
The severity of CVE-2022-48565 is critical with a severity value of 9.8.
How does CVE-2022-48565 affect Python?
CVE-2022-48565 affects Python through version 3.9.1.
What is the remedy for CVE-2022-48565?
Please update to the recommended versions: Python 2.7.17-1~18.04ubuntu1.13+ (Ubuntu Bionic), Python 2.7.6-8ubuntu0.6+ (Ubuntu Trusty), Python 2.7.12-1ubuntu0~16.04.18+ (Ubuntu Xenial), Python 3.5.2-2ubuntu0~16.04.13+ (Ubuntu Xenial), or Python 3.9.5-3~20.04.1 (Ubuntu Focal).
Where can I find more information about CVE-2022-48565?
You can find more information about CVE-2022-48565 on the following references: [Link 1](https://bugs.python.org/issue42051), [Link 2](https://launchpad.net/bugs/cve/CVE-2022-48565), [Link 3](https://github.com/python/cpython/issues/86217).