CVE-2022-48565: XEE
An XML External Entity (XXE) issue was discovered in Python through 3.9.1. The plistlib module no longer accepts entity declarations in XML plist files to avoid XML vulnerabilities.
Other sources
Python could allow a local authenticated attacker to obtain sensitive information, caused by improper handling of XML external entity (XXE) declarations by the plistlib module. By using a specially crafted XML content, a remote attacker could exploit this vulnerability to obtain sensitive information, and use this information to launch further attacks against the affected system.
— IBM
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2022-48565?
CVE-2022-48565 is an XML External Entity (XXE) issue in Python through 3.9.1.
What is the severity of CVE-2022-48565?
The severity of CVE-2022-48565 is critical with a severity value of 9.8.
How does CVE-2022-48565 affect Python?
CVE-2022-48565 affects Python through version 3.9.1.
What is the remedy for CVE-2022-48565?
Please update to the recommended versions: Python 2.7.17-1~18.04ubuntu1.13+ (Ubuntu Bionic), Python 2.7.6-8ubuntu0.6+ (Ubuntu Trusty), Python 2.7.12-1ubuntu0~16.04.18+ (Ubuntu Xenial), Python 3.5.2-2ubuntu0~16.04.13+ (Ubuntu Xenial), or Python 3.9.5-3~20.04.1 (Ubuntu Focal).
Where can I find more information about CVE-2022-48565?
You can find more information about CVE-2022-48565 on the following references: [Link 1](https://bugs.python.org/issue42051), [Link 2](https://launchpad.net/bugs/cve/CVE-2022-48565), [Link 3](https://github.com/python/cpython/issues/86217).