Vulnerability Details : CVE-2022-48565
Potential exploit
An XML External Entity (XXE) issue was discovered in Python through 3.9.1. The plistlib module no longer accepts entity declarations in XML plist files to avoid XML vulnerabilities.
Vulnerability category: XML external entity (XXE) injection
Products affected by CVE-2022-48565
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
- cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
- cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
- cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
- cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2022-48565
4.12%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 88 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2022-48565
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
9.8
|
CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
3.9
|
5.9
|
NIST |
CWE ids for CVE-2022-48565
-
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.Assigned by: nvd@nist.gov (Primary)
References for CVE-2022-48565
-
https://bugs.python.org/issue42051
Issue 42051: [security] Avoid plistlib XML vulnerabilities by rejecting entity directives - Python trackerExploit;Issue Tracking;Patch;Vendor Advisory
-
https://lists.debian.org/debian-lts-announce/2023/10/msg00017.html
[SECURITY] [DLA 3614-1] python3.7 security update
-
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BAYWJD576JUKLHCWKDLMJSUGTRDKPF3M/
[SECURITY] Fedora 39 Update: python2.7-2.7.18-35.fc39 - package-announce - Fedora Mailing-Lists
-
https://lists.debian.org/debian-lts-announce/2023/09/msg00022.html
[SECURITY] [DLA 3575-1] python2.7 security updateThird Party Advisory
-
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KZRZRJHWLZ7MOJNPQBWGJVXMVYDC5BRA/
[SECURITY] Fedora 37 Update: python2.7-2.7.18-35.fc37 - package-announce - Fedora Mailing-Lists
-
https://security.netapp.com/advisory/ntap-20231006-0007/
CVE-2022-48565 Python Vulnerability in NetApp Products | NetApp Product Security
-
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AFHYAGWBFBNUGWU6XWKBHTCV5NH77MB7/
[SECURITY] Fedora 38 Update: python2.7-2.7.18-35.fc38 - package-announce - Fedora Mailing-Lists
Jump to