PT-2022-7023 · Python+6 · Python+6
Devin Jeanpierre
·
Published
2022-10-16
·
Updated
2025-08-11
·
CVE-2022-48566
CVSS v2.0
7.1
High
| Vector | AV:N/AC:H/Au:S/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Python versions through 3.9.1
Python version 3.12.0b1
Description
The issue is related to the hmac.compare digest function in the Lib/hmac.py module, where constant-time-defeating optimisations were possible in the accumulator variable. This could potentially allow a remote attacker to elevate their privileges due to a race condition. Additionally, an XML External Entity (XXE) issue was discovered, which has been mitigated by the plistlib module no longer accepting entity declarations in XML plist files. There is also an issue in the asyncio. swap current task() component that allows an attacker to obtain sensitive information.
Recommendations
For Python versions through 3.9.1, consider updating to a version where the hmac.compare digest function has been patched to prevent constant-time-defeating optimisations.
For Python version 3.12.0b1, restrict access to the asyncio. swap current task() component to minimize the risk of exploitation.
As a temporary workaround, consider disabling the use of entity declarations in XML plist files until the issue is resolved.
Avoid using the plistlib module with untrusted XML plist files until the XXE issue is fully addressed.
Exploit
Fix
Race Condition
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Linuxmint
Python
Red Os
Suse
Ubuntu