PT-2022-7024 · Python+10 · Python+10
Published
2019-05-07
·
Updated
2026-02-21
·
CVE-2022-48565
CVSS v2.0
10
Critical
| Vector | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Python versions prior to 3.9.1
Python version 3.8.7 and earlier
Description
The issue is related to an XML External Entity (XXE) problem in the plistlib module of the Python programming language interpreter. This is due to the incorrect restriction of XML links to external objects. Exploitation of the issue may allow a remote attacker to conduct XXE attacks. The plistlib module no longer accepts entity declarations in XML plist files to avoid XML vulnerabilities.
Recommendations
For Python versions prior to 3.9.1, update to version 3.9.1 or later to resolve the issue.
For Python version 3.8 lineage, update to version 3.8.7 or later to resolve the issue.
As a temporary workaround, consider disabling the use of entity declarations in XML plist files for the plistlib module until a patch is available.
Restrict access to the plistlib module to minimize the risk of exploitation.
Exploit
Fix
XXE
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Centos
Linuxmint
Python
Red Hat
Red Os
Rocky Linux
Suse
Ubuntu