An XML External Entity (XXE) issue was discovered in Python through 3.9.1. The plistlib module no longer accepts entity declarations in XML plist file...

原文の説明

取得元が公開している説明をそのまま載せています (多くは英語)。

An XML External Entity (XXE) issue was discovered in Python through 3.9.1. The plistlib module no longer accepts entity declarations in XML plist files to avoid XML vulnerabilities.

出典: OSV.dev (Open Source Vulnerabilities) OSV

影響パッケージ

Ubuntu:Pro:14.04:LTS python2.7

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-8ubuntu0.6+esm16"}]}]

Ubuntu:Pro:14.04:LTS python3.5

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.2-2ubuntu0~16.04.4~14.04.1+esm1"}]}]

Ubuntu:Pro:14.04:LTS python3.4

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Ubuntu:Pro:16.04:LTS python2.7

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.12-1ubuntu0~16.04.18+esm6"}]}]

Ubuntu:Pro:16.04:LTS python3.5

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.2-2ubuntu0~16.04.13+esm9"}]}]

Ubuntu:Pro:18.04:LTS python2.7

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.17-1~18.04ubuntu1.13+esm1"}]}]

Ubuntu:Pro:18.04:LTS python3.6

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.9-1~18.04ubuntu1.13+esm2"}]}]

Ubuntu:Pro:18.04:LTS python3.7

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.5-2ubuntu1~18.04.2+esm3"}]}]

Ubuntu:Pro:18.04:LTS python3.8

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.0-3ubuntu1~18.04.2+esm2"}]}]

Ubuntu:20.04:LTS python2.7

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.18-1~20.04.7"}]}]

Ubuntu:20.04:LTS python3.9

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.5-3~20.04.1"}]}]

Ubuntu:22.04:LTS python2.7

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.18-13ubuntu1.5"}]}]

参照URL

advisory ubuntu.com
advisory ubuntu.com
advisory ubuntu.com
report ubuntu.com
report github.com
report github.com
report github.com
report cve.org