CVE-2022-48564: Medium severity python 2.7 vulnerability
Last updated 24 July 2024
Other sources
Python is vulnerable to a denial of service, caused by a flaw in the readints function in plistlib.py. By persuading a victim to open a specially crafted Apple Property List file file, a remote attacker could exploit this vulnerability to cause CPU and RAM exhaustion, and results in a denial of service condition.
— IBM
readints in plistlib.py in Python through 3.9.1 is vulnerable to a potential DoS attack via CPU and RAM exhaustion when processing malformed Apple Property List files in binary format.
— Launchpad
The Python's readints() in plistlib.py is vulnerable to a potential DoS attack via CPU and RAM exhaustion when processing malformed Apple Property List files in binary format.
https://bugs.python.org/issue42103 https://github.com/python/cpython/issues/86269 https://github.com/python/cpython/commit/34637a0ce21e7261b952fbd9d006474cc29b681f (v3.10.0a2) https://github.com/python/cpython/commit/e277cb76989958fdbc092bf0b2cb55c43e86610a (v3.9.1rc1) https://github.com/python/cpython/commit/547d2bcc55e348043b2f338027c1acd9549ada76 (v3.8.7rc1) https://github.com/python/cpython/commit/225e3659556616ad70186e7efc02baeebfeb5ec4 (v3.7.10) https://github.com/python/cpython/commit/a63234c49b2fbfb6f0aca32525e525ce3d43b2b4 (v3.6.13)
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2022-48564?
CVE-2022-48564 is a vulnerability in Python through 3.9.1 that can lead to a potential denial-of-service (DoS) attack via CPU and RAM exhaustion when processing malformed Apple Property List files in binary format.
How does CVE-2022-48564 affect Python?
CVE-2022-48564 affects Python versions up to and including 3.9.1.
What is the severity level of CVE-2022-48564?
The severity level of CVE-2022-48564 is medium with a CVSS score of 6.5.
How can I mitigate the impact of CVE-2022-48564?
To mitigate the impact of CVE-2022-48564, it is recommended to update Python to version 3.9.2 or later.
Where can I find more information about CVE-2022-48564?
More information about CVE-2022-48564 can be found at the following references: [Link 1](https://bugs.python.org/issue42103), [Link 2](https://security.netapp.com/advisory/ntap-20230929-0009/).