CVE-2022-48565

NameCVE-2022-48565
DescriptionAn XML External Entity (XXE) issue was discovered in Python through 3.9.1. The plistlib module no longer accepts entity declarations in XML plist files to avoid XML vulnerabilities.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-3575-1, DLA-3614-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
python2.7 (PTS)buster2.7.16-2+deb10u1vulnerable
buster (security)2.7.16-2+deb10u3fixed
bullseye2.7.18-8+deb11u1fixed
python3.7 (PTS)buster3.7.3-2+deb10u3vulnerable
buster (security)3.7.3-2+deb10u6fixed
python3.9 (PTS)bullseye3.9.2-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
python2.7sourcebuster2.7.16-2+deb10u3DLA-3575-1
python2.7sourcebullseye2.7.18-8+deb11u1
python2.7source(unstable)(unfixed)
python3.7sourcebuster3.7.3-2+deb10u6DLA-3614-1
python3.7source(unstable)(unfixed)
python3.9source(unstable)3.9.1~rc1-1

Notes

https://bugs.python.org/issue42051
https://github.com/python/cpython/issues/86217
https://github.com/python/cpython/commit/05ee790f4d1cd8725a90b54268fc1dfe5b4d1fa2 (v3.10.0a2)
https://github.com/python/cpython/commit/479553c7c11306a09ce34edb6ef208133b7b95fe (v3.9.1rc1)
https://github.com/python/cpython/commit/65894cac0835cb8f469f649e20aa1be8bf89f5ae (v3.8.7rc1)
https://github.com/python/cpython/commit/e512bc799e3864fe3b1351757261762d63471efc (v3.7.10)
https://github.com/python/cpython/commit/a158fb9c5138db94adf24fbc5690467cda811163 (v3.6.13)

Search for package or bug name: Reporting problems