CVE-2022-48564
read_ints in plistlib.py in Python through 3.9.1 is vulnerable to a potential DoS attack via CPU and RAM exhaustion when processing malformed Apple Pr...
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
read_ints in plistlib.py in Python through 3.9.1 is vulnerable to a potential DoS attack via CPU and RAM exhaustion when processing malformed Apple Property List files in binary format.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
影響パッケージ
Bitnami
python-min
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.6.13"},{"introduced":"3.7.0"},{"fixed":"3.7.10"},{"introduced":"3.8.0"},{"fixed":"3.8.7"},{"introduced":"3.9.0"},{"fixed":"3.9.1"}]}]
Bitnami
libpython
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.6.13"},{"introduced":"3.7.0"},{"fixed":"3.7.10"},{"introduced":"3.8.0"},{"fixed":"3.8.7"},{"introduced":"3.9.0"},{"fixed":"3.9.1"}]}]
Bitnami
python
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.6.13"},{"introduced":"3.7.0"},{"fixed":"3.7.10"},{"introduced":"3.8.0"},{"fixed":"3.8.7"},{"introduced":"3.9.0"},{"fixed":"3.9.1"}]}]
ディストリビューション別の修正状況
各ディストリビューションが公開している、この CVE の修正パッケージ
- Debian DEBIAN-CVE-2022-48564 pypy3 修正版: 7.3.5+dfsg-2
- Ubuntu UBUNTU-CVE-2022-48564 python2.7 修正版: 2.7.6-8ubuntu0.6+esm18
参照URL
- advisory bugs.python.org
- advisory lists.debian.org
- advisory security.netapp.com
- web nvd.nist.gov