CVE-2022-48565
An XML External Entity (XXE) issue was discovered in Python through 3.9.1. The plistlib module no longer accepts entity declarations in XML plist file...
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
An XML External Entity (XXE) issue was discovered in Python through 3.9.1. The plistlib module no longer accepts entity declarations in XML plist files to avoid XML vulnerabilities.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
影響パッケージ
Bitnami
libpython
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.6.13"},{"introduced":"3.7.0"},{"fixed":"3.7.10"},{"introduced":"3.8.0"},{"fixed":"3.8.7"},{"introduced":"3.9.0"},{"fixed":"3.9.1"}]}]
Bitnami
python-min
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.6.13"},{"introduced":"3.7.0"},{"fixed":"3.7.10"},{"introduced":"3.8.0"},{"fixed":"3.8.7"},{"introduced":"3.9.0"},{"fixed":"3.9.1"}]}]
Bitnami
python
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.6.13"},{"introduced":"3.7.0"},{"fixed":"3.7.10"},{"introduced":"3.8.0"},{"fixed":"3.8.7"},{"introduced":"3.9.0"},{"fixed":"3.9.1"}]}]
ディストリビューション別の修正状況
各ディストリビューションが公開している、この CVE の修正パッケージ
- Debian DEBIAN-CVE-2022-48565 pypy3 修正版: 7.3.5+dfsg-2
- Ubuntu UBUNTU-CVE-2022-48565 python2.7 修正版: 2.7.6-8ubuntu0.6+esm16
参照URL
- advisory bugs.python.org
- advisory lists.debian.org
- web lists.debian.org
- web lists.fedoraproject.org
- web lists.fedoraproject.org
- web lists.fedoraproject.org
- web nvd.nist.gov
- web security.netapp.com