CVE-2022-48565

Advisory

Python 3.6.13, 3.7.10, 3.8.7 and 3.9.1 include a fix for CVE-2022-48565: XML External Entity vulnerability. The plistlib module no longer accepts entity declarations in XML plist files to avoid XML vulnerabilities.
https://bugs.python.org/issue42051

Affected package

Affected versions

Fixed versions

Vulnerability changelog

An XML External Entity (XXE) issue was discovered in Python through 3.9.1. The plistlib module no longer accepts entity declarations in XML plist files to avoid XML vulnerabilities. See CVE-2022-48565.


MISC:https://bugs.python.org/issue42051: https://bugs.python.org/issue42051

Resources

• https://bugs.python.org/issue42051
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-48565
• https://lists.debian.org/debian-lts-announce/2023/09/msg00022.html
• https://security.netapp.com/advisory/ntap-20231006-0007/
• https://lists.debian.org/debian-lts-announce/2023/10/msg00017.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KZRZRJHWLZ7MOJNPQBWGJVXMVYDC5BRA/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AFHYAGWBFBNUGWU6XWKBHTCV5NH77MB7/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BAYWJD576JUKLHCWKDLMJSUGTRDKPF3M/