CVE-2022-48565
An XML External Entity (XXE) issue was discovered in Python through 3.9.1. The plistlib module no longer accepts entity declarations in XML plist file...
Original description
The description as published by the source.
An XML External Entity (XXE) issue was discovered in Python through 3.9.1. The plistlib module no longer accepts entity declarations in XML plist files to avoid XML vulnerabilities.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Affected packages
Bitnami
libpython
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.6.13"},{"introduced":"3.7.0"},{"fixed":"3.7.10"},{"introduced":"3.8.0"},{"fixed":"3.8.7"},{"introduced":"3.9.0"},{"fixed":"3.9.1"}]}]
Bitnami
python-min
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.6.13"},{"introduced":"3.7.0"},{"fixed":"3.7.10"},{"introduced":"3.8.0"},{"fixed":"3.8.7"},{"introduced":"3.9.0"},{"fixed":"3.9.1"}]}]
Bitnami
python
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.6.13"},{"introduced":"3.7.0"},{"fixed":"3.7.10"},{"introduced":"3.8.0"},{"fixed":"3.8.7"},{"introduced":"3.9.0"},{"fixed":"3.9.1"}]}]
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2022-48565 pypy3 Fixed in: 7.3.5+dfsg-2
- Ubuntu UBUNTU-CVE-2022-48565 python2.7 Fixed in: 2.7.6-8ubuntu0.6+esm16
References
- advisory bugs.python.org
- advisory lists.debian.org
- web lists.debian.org
- web lists.fedoraproject.org
- web lists.fedoraproject.org
- web lists.fedoraproject.org
- web nvd.nist.gov
- web security.netapp.com