CVE-2022-48564

Advisory

Python 3.6.13, 3.7.10, 3.8.7 and 3.9.1 include a fix for CVE-2022-48564: read_ints in plistlib.py in Python is vulnerable to a potential DoS attack via CPU and RAM exhaustion when processing malformed Apple Property List files in binary format.
https://bugs.python.org/issue42103

Affected package

Affected versions

Fixed versions

Vulnerability changelog

read_ints in plistlib.py in Python through 3.9.1 is vulnerable to a potential DoS attack via CPU and RAM exhaustion when processing malformed Apple Property List files in binary format. See CVE-2022-48564.


MISC:https://bugs.python.org/issue42103: https://bugs.python.org/issue42103

Resources

• https://bugs.python.org/issue42103
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-48564
• https://security.netapp.com/advisory/ntap-20230929-0009/
• https://lists.debian.org/debian-lts-announce/2023/10/msg00017.html