CVE-2022-48565: An XML External Entity (XXE) issue was discovered in Python through 3.9.1

Critical severity · published Aug 22, 2023

CVE-2022-48565

An XML External Entity (XXE) issue was discovered in Python through 3.9.1

9.8

CVSS

5.1%

EPSS

On KEV

Description

An XML External Entity (XXE) issue was discovered in Python through 3.9.1. The plistlib module no longer accepts entity declarations in XML plist files to avoid XML vulnerabilities.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

None

Confidentiality

High

Integrity

High

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)5.1% · higher than 92% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Debian Linux · Debian

10.0 · source: NVD

Python · Python

before 3.6.13; 3.7.0 before 3.7.10; 3.8.0 before 3.8.7; 3.9.0 before 3.9.1 · source: NVD

Affected product

Debian Linux

Debian

All Debian Linux CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2022-48565

CVE.org

https://www.cve.org/CVERecord?id=CVE-2022-48565

Exploit

https://bugs.python.org/issue42051

Third Party Advisory

https://lists.debian.org/debian-lts-announce/2023/09/msg00022.html

lists.debian.org

https://lists.debian.org/debian-lts-announce/2023/10/msg00017.html

lists.fedoraproject.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AFHYAGWBFBNUGWU6XWKBHTCV5NH77MB7/

lists.fedoraproject.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BAYWJD576JUKLHCWKDLMJSUGTRDKPF3M/

lists.fedoraproject.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KZRZRJHWLZ7MOJNPQBWGJVXMVYDC5BRA/