CVE-2022-48564

Description

read_ints in plistlib.py in Python through 3.9.1 is vulnerable to a potential DoS attack via CPU and RAM exhaustion when processing malformed Apple Property List files in binary format.

How to fix CVE-2022-48564

To remediate CVE-2022-48564, upgrade the affected package to a fixed version below.

• Bitnami/libpython—upgrade to 3.6.13 or later
• Bitnami/python—upgrade to 3.6.13 or later
• —upgrade to 3.6.13 or later
• —upgrade to 7.3.5+dfsg-2 or later
• —upgrade to 3.9.1~rc1-1 or later

Is CVE-2022-48564 being exploited?

Low — EPSS is 0.1%, meaning exploitation activity has not been observed at scale.

Affected packages (5)

• from 0, < 3.6.13, >= 3.7.0, < 3.7.10, >= 3.8.0, < 3.8.7, >= 3.9.0, < 3.9.1
• from 0, < 3.6.13, >= 3.7.0, < 3.7.10, >= 3.8.0, < 3.8.7, >= 3.9.0, < 3.9.1
• from 0, < 3.6.13, >= 3.7.0, < 3.7.10, >= 3.8.0, < 3.8.7, >= 3.9.0, < 3.9.1
• from 0, < 7.3.5+dfsg-2
• from 0, < 3.9.1~rc1-1

CVSS scores

References (5)

• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2022-48564
• WEBbugs.python.org/issue42103
• WEBlists.debian.org/debian-lts-announce/2023/10/msg00017.html
• WEBnvd.nist.gov/vuln/detail/CVE-2022-48564
• WEB