CVE-2022-48565

Published: Aug 22, 2023Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

An XML External Entity (XXE) issue was discovered in Python through 3.9.1. The plistlib module no longer accepts entity declarations in XML plist files to avoid XML vulnerabilities.

Affected (5)

Products: Python: Python · Debian: Debian Linux

1 product

1 product

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Python Python	Before 3.6.13
Python Python	From 3.7.0 to 3.7.10
Python Python	From 3.8.0 to 3.8.7
Python Python	From 3.9.0 to 3.9.1

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 10.0

Related CWEs

CWE-611

Improper Restriction of XML External Entity Reference

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

References (14)

https://bugs.python.org/issue42051

Source: cve@mitre.org

ExploitIssue TrackingPatchVendor Advisory

https://lists.debian.org/debian-lts-announce/2023/09/msg00022.html

Source: cve@mitre.org

Third Party Advisory

https://lists.debian.org/debian-lts-announce/2023/10/msg00017.html

Source: cve@mitre.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AFHYAGWBFBNUGWU6XWKBHTCV5NH77MB7/

Source: cve@mitre.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BAYWJD576JUKLHCWKDLMJSUGTRDKPF3M/

Source: cve@mitre.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KZRZRJHWLZ7MOJNPQBWGJVXMVYDC5BRA/

Source: cve@mitre.org

https://security.netapp.com/advisory/ntap-20231006-0007/

Source: cve@mitre.org

https://bugs.python.org/issue42051