XML External Entity injection in Python - CVE-2022-48565

Vulnerability identifier: #VU80564

CSH Severity: Medium

CVSS v4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-48565

CWE-ID: CWE-611

Exploitation vector: Remote access

Exploit availability: Public exploit is available

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to insufficient validation of user-supplied XML input within the plistlib module. A remote attacker can pass a specially crafted XML code to the affected application and view contents of arbitrary files on the system or initiate requests to external systems.

Successful exploitation of the vulnerability may allow an attacker to view contents of arbitrary file on the server or perform network scanning of internal and external infrastructure.

Python
Amazon Linux AMI
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise High Performance Computing 12
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE Manager Proxy
SUSE Linux Enterprise Micro
Anolis OS
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
SUSE Linux Enterprise Workstation Extension 12
Ubuntu
SUSE Package Hub 15
openSUSE Leap
openEuler
Fedora
IBM Process Mining
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
VMware Tanzu Application Service for VMs
Isolation Segment
Dell EMC PowerProtect Data Protection
SmartFabric OS10
Platform Automation Toolkit
Enterprise SONiC
Robotic Process Automation for Cloud Pak
IBM Qradar SIEM
BIG-IP DNS
libpython2.7-stdlib (Ubuntu package)
libpython2.7 (Ubuntu package)
python3.11 (Ubuntu package)
python3.11-minimal (Ubuntu package)
python3.8 (Ubuntu package)
python3.8-minimal (Ubuntu package)
python3.9 (Ubuntu package)
python3.9-minimal (Ubuntu package)
python3.6 (Ubuntu package)
python3.6-minimal (Ubuntu package)
python3.7 (Ubuntu package)
python3.7-minimal (Ubuntu package)
python3.5 (Ubuntu package)
python3.5-minimal (Ubuntu package)
libpython3.5-stdlib (Ubuntu package)
libpython3.5 (Ubuntu package)
python2.7-minimal (Ubuntu package)
python2.7 (Ubuntu package)
python2-pluggy
python2-PyMySQL
python2-docutils
python2-markupsafe
python2-Cython
python2-wheel
python2-wheel-wheel
python2-scipy
python2-funcsigs
python2-backports
python2-ipaddress
python-sqlalchemy-doc
python2-sqlalchemy
python-nose-docs
python2-nose
python2-py
python2-pysocks
python2-pytest-mock
python2-six
python2-numpy-f2py
python2-numpy
python2-numpy-doc
python2-dns
python2-setuptools_scm
python2-urllib3
python2-mock
python2-pygments
python2-babel
babel
python2-idna
python-psycopg2-doc
python2-psycopg2-debug
python2-psycopg2
python2-psycopg2-tests
python2-docs-info
python2-docs
python27
python2
python2-debug
python2-devel
python2-test
python2-libs
python2-tkinter
python2-tools
python
libpython2_7-1_0-32bit
python-32bit
python-base-32bit
libpython2_7-1_0-debuginfo-32bit
python-doc-pdf
python-doc
python-tk-debuginfo
python-curses-debuginfo
libpython2_7-1_0
python-base-debuginfo
python-base-debuginfo-32bit
python-debuginfo-32bit
python-xml
python-gdbm-debuginfo
python-tk
python-base
python-debuginfo
python-curses
python-idle
python-gdbm
python-xml-debuginfo
python-demo
libpython2_7-1_0-debuginfo
python-base-debugsource
python-debugsource
python-devel
python2.7
python-32bit-debuginfo
python-base-32bit-debuginfo
libpython2_7-1_0-32bit-debuginfo
python2-jinja2
python2-requests
python2-chardet
python2-pytest
python2-backports-ssl_match_hostname
python2-bson
python2-pymongo
python2-pymongo-gridfs
python3-help
python3-devel
python3-debugsource
python3-debug
python3-debuginfo
python3
python3.10-minimal (Ubuntu package)
python3.10 (Ubuntu package)
python3.12 (Ubuntu package)
python3.12-minimal (Ubuntu package)
python2-pyyaml
python2-rpm-macros
python2-lxml
python2-coverage
python2-pip
python2-pip-wheel
python2-virtualenv
python2-attrs
python2-setuptools
python2-setuptools-wheel
python2-pytz
VMware Tanzu Operations Manager
RecoverPoint for VMs
Dell EMC NetWorker vProxy

Install updates from vendor's website.

Python - addressed in versions 3.7.10, 3.10.0
IBM Process Mining - update to 1.14.2
Dell EMC PowerProtect Data Protection - update to 2.7.8
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 4.8.0
IBM Qradar SIEM - update to 7.5.0 Update Pack 8
SmartFabric OS10 - addressed in versions 10.5.4.11, 10.5.6.1
BIG-IP DNS - update to 17.5.1
libpython2.7-stdlib (Ubuntu package) - update to Ubuntu Pro
libpython2.7 (Ubuntu package) - update to Ubuntu Pro (Infra-only)
python3.11 (Ubuntu package) - addressed in versions Ubuntu Pro, 3.11.6-3ubuntu0.1
python3.11-minimal (Ubuntu package) - addressed in versions Ubuntu Pro, 3.11.6-3ubuntu0.1
python3.8 (Ubuntu package) - addressed in versions Ubuntu Pro, 3.8.10-0ubuntu1~20.04.10
python3.8-minimal (Ubuntu package) - addressed in versions Ubuntu Pro, 3.8.10-0ubuntu1~20.04.10
python3.9 (Ubuntu package) - update to Ubuntu Pro
python3.9-minimal (Ubuntu package) - update to Ubuntu Pro
python3.6 (Ubuntu package) - update to Ubuntu Pro
python3.6-minimal (Ubuntu package) - update to Ubuntu Pro
python3.7 (Ubuntu package) - update to Ubuntu Pro
python3.7-minimal (Ubuntu package) - update to Ubuntu Pro
python3.5 (Ubuntu package) - update to Ubuntu Pro (Infra-only)
python3.5-minimal (Ubuntu package) - update to Ubuntu Pro
libpython3.5-stdlib (Ubuntu package) - update to Ubuntu Pro
libpython3.5 (Ubuntu package) - update to Ubuntu Pro (Infra-only)
python2.7-minimal (Ubuntu package) - update to Ubuntu Pro
python2.7 (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 2.7.18-1~20.04.7, 2.7.18-13ubuntu1.5
python2-pluggy - update to 0.6.0-8
python2-PyMySQL - update to 0.8.0-10
python2-docutils - update to 0.14-12
python2-markupsafe - update to 0.23-19
python2-Cython - update to 0.28.1-7
python2-wheel - update to 0.31.1-3
python2-wheel-wheel - update to 0.31.1-3
python2-scipy - update to 1.0.0-22
python2-funcsigs - update to 1.0.2-13
python2-backports - update to 1.0-16
python2-ipaddress - update to 1.0.18-6
python-sqlalchemy-doc - update to 1.3.2-2
python2-sqlalchemy - update to 1.3.2-2
python-nose-docs - update to 1.3.7-31
python2-nose - update to 1.3.7-31
python2-py - update to 1.5.3-6
python2-pysocks - update to 1.6.8-6
python2-pytest-mock - update to 1.9.0-4
python2-six - update to 1.11.0-6
python2-numpy-f2py - update to 1.14.2-16.0.1
python2-numpy - update to 1.14.2-16.0.1
python2-numpy-doc - update to 1.14.2-16.0.1
python2-dns - update to 1.15.0-10
python2-setuptools_scm - update to 1.15.7-6
python2-urllib3 - update to 1.24.2-4
python2-mock - update to 2.0.0-13
python2-pygments - update to 2.2.0-22
python2-babel - update to 2.5.1-10
babel - update to 2.5.1-10
python2-idna - update to 2.5-7
python-psycopg2-doc - update to 2.7.5-8
python2-psycopg2-debug - update to 2.7.5-8
python2-psycopg2 - update to 2.7.5-8
python2-psycopg2-tests - update to 2.7.5-8
python2-docs-info - update to 2.7.16-2
python2-docs - update to 2.7.16-2
python27 - update to 2.7.18-2.149
python2 - update to 2.7.18-17.0.1
python2-debug - update to 2.7.18-17.0.1
python2-devel - update to 2.7.18-17.0.1
python2-test - update to 2.7.18-17.0.1
python2-libs - update to 2.7.18-17.0.1
python2-tkinter - update to 2.7.18-17.0.1
python2-tools - update to 2.7.18-17.0.1
python - addressed in versions 2.7.18-33.26.1, 2.7.18-150000.57.1
libpython2_7-1_0-32bit - addressed in versions 2.7.18-33.26.1, 2.7.18-150000.57.1
python-32bit - addressed in versions 2.7.18-33.26.1, 2.7.18-150000.57.1
python-base-32bit - addressed in versions 2.7.18-33.26.1, 2.7.18-150000.57.1
libpython2_7-1_0-debuginfo-32bit - update to 2.7.18-33.26.1
python-doc-pdf - addressed in versions 2.7.18-33.26.1, 2.7.18-150000.57.1
python-doc - addressed in versions 2.7.18-33.26.1, 2.7.18-150000.57.1
python-tk-debuginfo - addressed in versions 2.7.18-33.26.1, 2.7.18-150000.57.1
python-curses-debuginfo - addressed in versions 2.7.18-33.26.1, 2.7.18-150000.57.1
libpython2_7-1_0 - addressed in versions 2.7.18-33.26.1, 2.7.18-150000.57.1
python-base-debuginfo - addressed in versions 2.7.18-33.26.1, 2.7.18-150000.57.1
python-base-debuginfo-32bit - update to 2.7.18-33.26.1
python-debuginfo-32bit - update to 2.7.18-33.26.1
python-xml - addressed in versions 2.7.18-33.26.1, 2.7.18-150000.57.1
python-gdbm-debuginfo - addressed in versions 2.7.18-33.26.1, 2.7.18-150000.57.1
python-tk - addressed in versions 2.7.18-33.26.1, 2.7.18-150000.57.1
python-base - addressed in versions 2.7.18-33.26.1, 2.7.18-150000.57.1
python-debuginfo - addressed in versions 2.7.18-33.26.1, 2.7.18-150000.57.1
python-curses - addressed in versions 2.7.18-33.26.1, 2.7.18-150000.57.1
python-idle - addressed in versions 2.7.18-33.26.1, 2.7.18-150000.57.1
python-gdbm - addressed in versions 2.7.18-33.26.1, 2.7.18-150000.57.1
python-xml-debuginfo - addressed in versions 2.7.18-33.26.1, 2.7.18-150000.57.1
python-demo - addressed in versions 2.7.18-33.26.1, 2.7.18-150000.57.1
libpython2_7-1_0-debuginfo - addressed in versions 2.7.18-33.26.1, 2.7.18-150000.57.1
python-base-debugsource - addressed in versions 2.7.18-33.26.1, 2.7.18-150000.57.1
python-debugsource - addressed in versions 2.7.18-33.26.1, 2.7.18-150000.57.1
python-devel - addressed in versions 2.7.18-33.26.1, 2.7.18-150000.57.1
python2.7 - addressed in versions 2.7.18-35.fc37, 2.7.18-35.fc38, 2.7.18-35.fc39, 2.7.18-35.fc40
python-32bit-debuginfo - update to 2.7.18-150000.57.1
python-base-32bit-debuginfo - update to 2.7.18-150000.57.1
libpython2_7-1_0-32bit-debuginfo - update to 2.7.18-150000.57.1
python2-jinja2 - update to 2.10-10
VMware Tanzu Operations Manager - update to 2.10.62
python2-requests - update to 2.20.0-4
python2-chardet - update to 3.0.4-10
VMware Tanzu Application Service for VMs - addressed in versions 3.0.18, 4.0.10
Isolation Segment - addressed in versions 3.0.18, 4.0.10
python2-pytest - update to 3.4.2-13
python2-backports-ssl_match_hostname - update to 3.5.0.1-12
python2-bson - update to 3.7.0-1.0.1
python2-pymongo - update to 3.7.0-1.0.1
python2-pymongo-gridfs - update to 3.7.0-1.0.1
python3-help - addressed in versions 3.7.9-33, 3.7.9-34
python3-devel - addressed in versions 3.7.9-33, 3.7.9-34
python3-debugsource - addressed in versions 3.7.9-33, 3.7.9-34
python3-debug - addressed in versions 3.7.9-33, 3.7.9-34
python3-debuginfo - addressed in versions 3.7.9-33, 3.7.9-34
python3 - addressed in versions 3.7.9-33, 3.7.9-34
python3.10-minimal (Ubuntu package) - update to 3.10.12-1~22.04.4
python3.10 (Ubuntu package) - update to 3.10.12-1~22.04.4
python3.12 (Ubuntu package) - update to 3.12.0-1ubuntu0.1
python3.12-minimal (Ubuntu package) - update to 3.12.0-1ubuntu0.1
python2-pyyaml - update to 3.12-16
python2-rpm-macros - update to 3-38
Platform Automation Toolkit - addressed in versions 4.0.13, 4.1.13, 4.2.8, 4.3.5
Enterprise SONiC - update to 4.1.2
python2-lxml - update to 4.2.3-6
python2-coverage - update to 4.5.1-5
RecoverPoint for VMs - update to 6.0.SP1.P1
python2-pip - update to 9.0.3-19.0.1
python2-pip-wheel - update to 9.0.3-19.0.1
python2-virtualenv - update to 15.1.0-22
python2-attrs - update to 17.4.0-10
Dell EMC NetWorker vProxy - addressed in versions 19.9.0.4, 19.10
Robotic Process Automation for Cloud Pak - addressed in versions 21.0.7.11, 23.0.11
python2-setuptools - update to 39.0.1-14
python2-setuptools-wheel - update to 39.0.1-14
python2-pytz - update to 2017.2-13

• Exploit #10858 - CVE-2022-48565-POC (A proof-of-concept for CVE-2022-48565 - python plistlib XML deserialisation attack) (November 15, 2024)

• https://bugs.python.org/issue42051
• https://github.com/python/cpython/commit/05ee790f4d1cd8725a90b54268fc1dfe5b4d1fa2
• https://github.com/python/cpython/commit/479553c7c11306a09ce34edb6ef208133b7b95fe
• https://github.com/python/cpython/commit/e512bc799e3864fe3b1351757261762d63471efc

• XXE in Python plistlib
• Ubuntu update for python2.7
• Fedora 40 update for python2.7
• Fedora 38 update for python2.7
• Fedora 39 update for python2.7
• Fedora 37 update for python2.7
• Multiple vulnerabilities in IBM Process Mining
• SUSE update for python
• VMware Tanzu products update for Python
• Amazon Linux AMI update for python27
• SUSE update for python
• Multiple vulnerabilities in Dell EMC Enterprise SONiC
• Multiple vulnerabilities in IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
• Dell EMC NetWorker vProxy update for third-party components
• Multiple vulnerabilities in IBM Robotic Process Automation for Cloud Pak
• openEuler 20.03 LTS SP1 update for python3
• openEuler 20.03 LTS SP3 update for python3
• Multiple vulnerabilities in IBM QRadar SIEM
• Multiple vulnerabilities in Dell Networking OS10
• Red Hat Enterprise Linux 8 update for the python27:2.7 module
• Ubuntu update for python3.10
• Multiple vulnerabilities in Dell SmartFabric OS10
• Ubuntu update for python2.7
• Multiple vulnerabilities in Dell RecoverPoint for Virtual Machines
• Anolis OS update for python27:2.7 module
• PowerProtect Data Protection software update for third-party components
• F5 BIG-IP (DNS) big3d component update for Python