Skip to content

[security] CVE-2022-48565: Avoid plistlib XML vulnerabilities by rejecting entity directives #86217

@vstinner

Description

@vstinner
BPO 42051
Nosy @ronaldoussoren, @vstinner, @tiran, @ned-deily, @serhiy-storchaka, @miss-islington
PRs
  • bpo-42051: Reject XML entity declarations in plist files #22760
  • [3.9] bpo-42051: Reject XML entity declarations in plist files (GH-22760) #22771
  • [3.8] bpo-42051: Reject XML entity declarations in plist files (GH-22760) #22772
  • [3.7] bpo-42051: Reject XML entity declarations in plist files (#22760) #22801
  • [3.6] bpo-42051: Reject XML entity declarations in plist files (GH-22760) (GH-22801) #22804
  • Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.

    Show more details

    GitHub fields:

    assignee = None
    closed_at = <Date 2020-10-20.04:44:06.570>
    created_at = <Date 2020-10-16.08:32:10.097>
    labels = ['type-security', '3.8', '3.9', '3.10', '3.7', 'library']
    title = '[security] Avoid plistlib XML vulnerabilities by rejecting entity directives'
    updated_at = <Date 2020-10-27.02:31:34.577>
    user = 'https://github.com/vstinner'

    bugs.python.org fields:

    activity = <Date 2020-10-27.02:31:34.577>
    actor = 'vstinner'
    assignee = 'none'
    closed = True
    closed_date = <Date 2020-10-20.04:44:06.570>
    closer = 'ned.deily'
    components = ['Library (Lib)']
    creation = <Date 2020-10-16.08:32:10.097>
    creator = 'vstinner'
    dependencies = []
    files = []
    hgrepos = []
    issue_num = 42051
    keywords = ['patch', 'security_issue']
    message_count = 13.0
    messages = ['378707', '378711', '378861', '378863', '378868', '378932', '378935', '378975', '379079', '379080', '379081', '379084', '379715']
    nosy_count = 6.0
    nosy_names = ['ronaldoussoren', 'vstinner', 'christian.heimes', 'ned.deily', 'serhiy.storchaka', 'miss-islington']
    pr_nums = ['22760', '22771', '22772', '22801', '22804']
    priority = 'normal'
    resolution = 'fixed'
    stage = 'resolved'
    status = 'closed'
    superseder = None
    type = 'security'
    url = 'https://bugs.python.org/issue42051'
    versions = ['Python 3.6', 'Python 3.7', 'Python 3.8', 'Python 3.9', 'Python 3.10']

    Metadata

    Metadata

    Assignees

    No one assigned

      Labels

      3.10only security fixes3.7 (EOL)end of life3.8 (EOL)end of life3.9only security fixesstdlibPython modules in the Lib dirtype-securityA security issue

      Projects

      No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions

        pFad - Phonifier reborn

        Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

        Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


        Alternative Proxies:

        Alternative Proxy

        pFad Proxy

        pFad v3 Proxy

        pFad v4 Proxy