PT-2022-7023 · Python+6 · Python+6

Devin Jeanpierre

·

Published

2022-10-16

·

Updated

2025-08-11

·

CVE-2022-48566

CVSS v2.0

7.1

High

VectorAV:N/AC:H/Au:S/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions Python versions through 3.9.1 Python version 3.12.0b1
Description The issue is related to the hmac.compare digest function in the Lib/hmac.py module, where constant-time-defeating optimisations were possible in the accumulator variable. This could potentially allow a remote attacker to elevate their privileges due to a race condition. Additionally, an XML External Entity (XXE) issue was discovered, which has been mitigated by the plistlib module no longer accepting entity declarations in XML plist files. There is also an issue in the asyncio. swap current task() component that allows an attacker to obtain sensitive information.
Recommendations For Python versions through 3.9.1, consider updating to a version where the hmac.compare digest function has been patched to prevent constant-time-defeating optimisations. For Python version 3.12.0b1, restrict access to the asyncio. swap current task() component to minimize the risk of exploitation. As a temporary workaround, consider disabling the use of entity declarations in XML plist files until the issue is resolved. Avoid using the plistlib module with untrusted XML plist files until the XXE issue is fully addressed.

Exploit

Fix

Race Condition

Found an issue in the description? Have something to add? Feel free to write us 👾

Weakness Enumeration

Related Identifiers

ALT-PU-2024-3474
BDU:2023-06654
BIT-LIBPYTHON-2022-48566
BIT-PYTHON-2022-48566
BIT-PYTHON-2023-38898
BIT-PYTHON-MIN-2022-48566
CVE-2022-48566
DLA-3575-1
DLA-3614-1
GHSA-CGFH-JP5W-8CMX
GHSA-CRHM-WC96-7579
MGASA-2024-0084
OESA-2023-1639
OESA-2023-1640
OPENSUSE-SU-2023_4220-1
OPENSUSE-SU-2024:13253-1
PSF-2023-5
PSF-2023-6
PSF-2023-7
ROSA-SA-2025-2646
SUSE-SU-2023:4001-1
SUSE-SU-2023:4220-1
SUSE-SU-2024:0464-1
SUSE-SU-2024:0901-1
SUSE-SU-2024:1847-1
SUSE-SU-2024_0901-1
SUSE-SU-2024_1847-1
USN-6400-1
USN-6891-1
USN-7180-1

Affected Products

Alt Linux
Astra Linux
Linuxmint
Python
Red Os
Suse
Ubuntu