CVE-2022-48565

Description

An XML External Entity (XXE) issue was discovered in Python through 3.9.1. The plistlib module no longer accepts entity declarations in XML plist files to avoid XML vulnerabilities.

How to fix CVE-2022-48565

To remediate CVE-2022-48565, upgrade the affected package to a fixed version below.

Bitnami/libpython—upgrade to 3.6.13 or later
Bitnami/python—upgrade to 3.6.13 or later
—upgrade to 3.6.13 or later
—upgrade to 7.3.5+dfsg-2 or later
—upgrade to 2.7.18-8+deb11u1 or later
—upgrade to 3.9.1~rc1-1 or later

Is CVE-2022-48565 being exploited?

Low — EPSS is 4.3%, meaning exploitation activity has not been observed at scale.

Affected packages (6)

from 0, < 3.6.13, >= 3.7.0, < 3.7.10, >= 3.8.0, < 3.8.7, >= 3.9.0, < 3.9.1
from 0, < 3.6.13, >= 3.7.0, < 3.7.10, >= 3.8.0, < 3.8.7, >= 3.9.0, < 3.9.1
from 0, < 3.6.13, >= 3.7.0, < 3.7.10, >= 3.8.0, < 3.8.7, >= 3.9.0, < 3.9.1
from 0, < 7.3.5+dfsg-2
from 0, < 2.7.18-8+deb11u1
from 0, < 3.9.1~rc1-1

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	CRITICAL9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H