CVE-2022-48565
published 2023-08-22CVE-2022-48565: An XML External Entity (XXE) issue was discovered in Python through 3.9.1. The plistlib module no longer accepts entity declarations in XML plist files to…
PriorityP352critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
4.27%
90.0th percentile
An XML External Entity (XXE) issue was discovered in Python through 3.9.1. The plistlib module no longer accepts entity declarations in XML plist files to avoid XML vulnerabilities.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | pypy3 | < pypy3 7.3.5+dfsg-2 (bookworm) | pypy3 7.3.5+dfsg-2 (bookworm) |
| debian | python2.7 | < pypy3 7.3.5+dfsg-2 (bookworm) | pypy3 7.3.5+dfsg-2 (bookworm) |
| debian | python3.9 | < pypy3 7.3.5+dfsg-2 (bookworm) | pypy3 7.3.5+dfsg-2 (bookworm) |
| python | python | < 3.6.13 | 3.6.13 |
| python | python | >= 3.7.0 < 3.7.10 | 3.7.10 |
| python | python | >= 3.8.0 < 3.8.7 | 3.8.7 |
| python | python | >= 3.9.0 < 3.9.1 | 3.9.1 |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
osv9.8CRITICAL
vendor_debian9.8CRITICAL
vendor_redhat9.8CRITICAL
vendor_ubuntu7.6HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Python vulnerabilities
vendor_ubuntu·2025-01-06·CVSS 7.5
CVE-2022-48560 [HIGH] Python vulnerabilities
Title: Python vulnerabilities
Summary: Several security issues were fixed in Python 2.7.
It was discovered that Python incorrectly handled certain scripts.
An attacker could possibly use this issue to execute arbitrary code
or cause a crash. (CVE-2022-48560)
It was discovered that Python did not properly handle XML entity
declarations in plist files. An attacker could possibly use this
vulnerability to perform an XML External Entity (XXE) injection,
resulting in a denial of service or information disclosure.
(CVE-2022-48565)
It was discovered that Python did not properly provide constant-time
processing for a crypto operation. An attacker could possibly use this
issue to perform a timing attack and recover sensitive information.
(CVE-2022-48566)
It was discovered that Python incorrect
Ubuntu
Python vulnerabilities
vendor_ubuntu·2024-07-11·CVSS 7.6
CVE-2021-29921 [HIGH] Python vulnerabilities
Title: Python vulnerabilities
Summary: Several security issues were fixed in Python.
It was discovered that Python incorrectly handled certain inputs.
An attacker could possibly use this issue to execute arbitrary code.
This issue only affected Ubuntu 14.04 LTS and Ubuntu 18.04 LTS.
(CVE-2015-20107)
It was discovered that Python incorrectly used regular expressions
vulnerable to catastrophic backtracking. A remote attacker could possibly
use this issue to cause a denial of service. This issue only affected
Ubuntu 14.04 LTS. (CVE-2018-1060, CVE-2018-1061)
It was discovered that Python failed to initialize Expat’s hash salt. A
remote attacker could possibly use this issue to cause hash collisions,
leading to a denial of service. This issue only affected Ubuntu 14.04 LTS.
(CVE-2018-14647)
Ubuntu
Python vulnerability
vendor_ubuntu·2023-09-07
CVE-2022-48565 Python vulnerability
Title: Python vulnerability
Summary: Python could be made to crash or leak sensitive information if it
received specially crafted input.
It was discovered that Python did not properly handle XML entity
declarations in plist files. An attacker could possibly use this
vulnerability to perform an XML External Entity (XXE) injection,
resulting in a denial of service or information disclosure.
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
python: XML External Entity in XML processing plistlib module
vendor_redhat·2023-08-22·CVSS 9.8
CVE-2022-48565 [CRITICAL] CWE-611 python: XML External Entity in XML processing plistlib module
python: XML External Entity in XML processing plistlib module
An XML External Entity (XXE) issue was discovered in Python through 3.9.1. The plistlib module no longer accepts entity declarations in XML plist files to avoid XML vulnerabilities.
A flaw was found in Python caused by improper handling of XML external entity (XXE) declarations by the plistlib module. By using a specially crafted XML content, an attacker could obtain sensitive information by disclosing files specified by parsing URI, and may cause denial of service by resource exhaustion.
Statement: This vulnerability is classified as Moderate according to Red Hat's Severity Rating Classification, as in contrast to an Important severity rating, the conditions to exploit this vulnerability makes it highly improbable for a gene
Debian
CVE-2022-48565: pypy3 - An XML External Entity (XXE) issue was discovered in Python through 3.9.1. The p...
vendor_debian·2022·CVSS 9.8
CVE-2022-48565 [CRITICAL] CVE-2022-48565: pypy3 - An XML External Entity (XXE) issue was discovered in Python through 3.9.1. The p...
An XML External Entity (XXE) issue was discovered in Python through 3.9.1. The plistlib module no longer accepts entity declarations in XML plist files to avoid XML vulnerabilities.
Scope: local
bookworm: resolved (fixed in 7.3.5+dfsg-2)
bullseye: resolved (fixed in 7.3.5+dfsg-2)
forky: resolved (fixed in 7.3.5+dfsg-2)
sid: resolved (fixed in 7.3.5+dfsg-2)
trixie: resolved (fixed in 7.3.5+dfsg-2)
OSV
python2.7 vulnerabilities
osv·2025-01-06·CVSS 7.5
CVE-2022-48560 [HIGH] python2.7 vulnerabilities
python2.7 vulnerabilities
It was discovered that Python incorrectly handled certain scripts.
An attacker could possibly use this issue to execute arbitrary code
or cause a crash. (CVE-2022-48560)
It was discovered that Python did not properly handle XML entity
declarations in plist files. An attacker could possibly use this
vulnerability to perform an XML External Entity (XXE) injection,
resulting in a denial of service or information disclosure.
(CVE-2022-48565)
It was discovered that Python did not properly provide constant-time
processing for a crypto operation. An attacker could possibly use this
issue to perform a timing attack and recover sensitive information.
(CVE-2022-48566)
It was discovered that Python incorrectly handled certain inputs. If a
user or an automated system were
OSV
python3.5, python3.6, python3.7, python3.8, python3.9, python3.10, python3.11, python3.12 vulnerabilities
osv·2024-07-11·CVSS 7.6
CVE-2015-20107 [HIGH] python3.5, python3.6, python3.7, python3.8, python3.9, python3.10, python3.11, python3.12 vulnerabilities
python3.5, python3.6, python3.7, python3.8, python3.9, python3.10, python3.11, python3.12 vulnerabilities
It was discovered that Python incorrectly handled certain inputs.
An attacker could possibly use this issue to execute arbitrary code.
This issue only affected Ubuntu 14.04 LTS and Ubuntu 18.04 LTS.
(CVE-2015-20107)
It was discovered that Python incorrectly used regular expressions
vulnerable to catastrophic backtracking. A remote attacker could possibly
use this issue to cause a denial of service. This issue only affected
Ubuntu 14.04 LTS. (CVE-2018-1060, CVE-2018-1061)
It was discovered that Python failed to initialize Expat’s hash salt. A
remote attacker could possibly use this issue to cause hash collisions,
leading to a denial of service. This issue only affected Ubuntu 14.04 L
GHSA
GHSA-crhm-wc96-7579: An XML External Entity (XXE) issue was discovered in Python through 3
ghsa_unreviewed·2023-08-22
CVE-2022-48565 [CRITICAL] CWE-611 GHSA-crhm-wc96-7579: An XML External Entity (XXE) issue was discovered in Python through 3
An XML External Entity (XXE) issue was discovered in Python through 3.9.1. The plistlib module no longer accepts entity declarations in XML plist files to avoid XML vulnerabilities.
OSV
CVE-2022-48565: An XML External Entity (XXE) issue was discovered in Python through 3
osv·2023-08-22·CVSS 9.8
CVE-2022-48565 [CRITICAL] CVE-2022-48565: An XML External Entity (XXE) issue was discovered in Python through 3
An XML External Entity (XXE) issue was discovered in Python through 3.9.1. The plistlib module no longer accepts entity declarations in XML plist files to avoid XML vulnerabilities.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://bugs.python.org/issue42051https://lists.debian.org/debian-lts-announce/2023/09/msg00022.htmlhttps://lists.debian.org/debian-lts-announce/2023/10/msg00017.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AFHYAGWBFBNUGWU6XWKBHTCV5NH77MB7/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BAYWJD576JUKLHCWKDLMJSUGTRDKPF3M/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KZRZRJHWLZ7MOJNPQBWGJVXMVYDC5BRA/https://security.netapp.com/advisory/ntap-20231006-0007/https://bugs.python.org/issue42051https://lists.debian.org/debian-lts-announce/2023/09/msg00022.htmlhttps://lists.debian.org/debian-lts-announce/2023/10/msg00017.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AFHYAGWBFBNUGWU6XWKBHTCV5NH77MB7/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BAYWJD576JUKLHCWKDLMJSUGTRDKPF3M/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KZRZRJHWLZ7MOJNPQBWGJVXMVYDC5BRA/https://security.netapp.com/advisory/ntap-20231006-0007/
2023-08-22
Published