CVE-2022-48565 XML external entity in n/a
An XML External Entity vulnerability in Python's plistlib module allows attackers to read files or cause denial of service via crafted XML plists.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-48565?
CVE-2022-48565 is a critical vulnerability in Debian Debian Linux, published on 22 Aug 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An XML External Entity (XXE) issue was discovered in Python through 3.9.1. The plistlib module no longer accepts entity declarations in XML plist files to avoid XML vulnerabilities.
Weakness: CWE-611
Which versions are affected by CVE-2022-48565?
3 open source packages ship an affected version, including libpython, python and python-min. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
libpython Bitnami | All versions | 3.6.13, 3.7.10, 3.8.7, 3.9.1 |
python Bitnami | All versions | 3.6.13, 3.7.10, 3.8.7, 3.9.1 |
python-min Bitnami | All versions | 3.6.13, 3.7.10, 3.8.7, 3.9.1 |
Products include Debian Debian Linux, Python Python.
How do I fix CVE-2022-48565?
Upgrade libpython to a fixed version for your release line: 3.6.13, 3.7.10, 3.8.7 or 3.9.1.
Is CVE-2022-48565 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-48565 exists.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as AZL-109653, BIT-libpython-2022-48565, BIT-python-2022-48565, BIT-python-min-2022-48565, CLSA-2023-1694538236, CLSA-2023-1694538434 and 15 more.