CVE-2022-48565

An XML External Entity (XXE) issue was discovered in Python through 3.9.1. The plistlib module no longer accepts entity declarations in XML plist files to avoid XML vulnerabilities.

CVSS v3.1 NVD

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

5.07% chance of exploitation in the next 30 days, 92nd percentile

Published

2023-08-22

Updated

2024-10-03

Proof-of-concept exploits (2)

• Einstein2150/CVE-2022-48565-POC3★ · 2024-10-28
• Einstein2150/CVE-2022-48656-POC3★ · 2024-10-28

Security advisories

• https://bugs.python.org/issue42051
• https://lists.debian.org/debian-lts-announce/2023/09/msg00022.html

References

• CVE Record
• NVD entry

Related

• CVE-2022-48656