Summary
It was discovered that Python did not properly handle XML entity
declarations in plist files. An attacker could possibly use this
vulnerability to perform an XML External Entity (XXE) injection,
resulting in a denial of service or information disclosure.
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | python2.7 | 2.7.6-8ubuntu0.6+esm16 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | python2.7 | 2.7.12-1ubuntu0~16.04.18+esm6 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | python3.5 | 3.5.2-2ubuntu0~16.04.13+esm9 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | python2.7 | 2.7.17-1~18.04ubuntu1.13+esm1 |
Vulnerabilities 1
-
Unscored —CVE-2022-48565 Public exploit
An XML External Entity (XXE) issue was discovered in Python through 3.9.1. The plistlib module no longer accepts entity…
References
-
report
https://ubuntu.com/security/CVE-2022-48565