Skip to content

[security] CVE-2022-48565: Avoid plistlib XML vulnerabilities by rejecting entity directives #86217

@vstinner

Description

@vstinner
BPO 42051
Nosy @ronaldoussoren, @vstinner, @tiran, @ned-deily, @serhiy-storchaka, @miss-islington
PRs
  • bpo-42051: Reject XML entity declarations in plist files #22760
  • [3.9] bpo-42051: Reject XML entity declarations in plist files (GH-22760) #22771
  • [3.8] bpo-42051: Reject XML entity declarations in plist files (GH-22760) #22772
  • [3.7] bpo-42051: Reject XML entity declarations in plist files (#22760) #22801
  • [3.6] bpo-42051: Reject XML entity declarations in plist files (GH-22760) (GH-22801) #22804
  • Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.

    Show more details

    GitHub fields:

    assignee = None closed_at = <Date 2020-10-20.04:44:06.570> created_at = <Date 2020-10-16.08:32:10.097> labels = ['type-security', '3.8', '3.9', '3.10', '3.7', 'library'] title = '[security] Avoid plistlib XML vulnerabilities by rejecting entity directives' updated_at = <Date 2020-10-27.02:31:34.577> user = 'https://github.com/vstinner'

    bugs.python.org fields:

    activity = <Date 2020-10-27.02:31:34.577> actor = 'vstinner' assignee = 'none' closed = True closed_date = <Date 2020-10-20.04:44:06.570> closer = 'ned.deily' components = ['Library (Lib)'] creation = <Date 2020-10-16.08:32:10.097> creator = 'vstinner' dependencies = [] files = [] hgrepos = [] issue_num = 42051 keywords = ['patch', 'security_issue'] message_count = 13.0 messages = ['378707', '378711', '378861', '378863', '378868', '378932', '378935', '378975', '379079', '379080', '379081', '379084', '379715'] nosy_count = 6.0 nosy_names = ['ronaldoussoren', 'vstinner', 'christian.heimes', 'ned.deily', 'serhiy.storchaka', 'miss-islington'] pr_nums = ['22760', '22771', '22772', '22801', '22804'] priority = 'normal' resolution = 'fixed' stage = 'resolved' status = 'closed' superseder = None type = 'security' url = 'https://bugs.python.org/issue42051' versions = ['Python 3.6', 'Python 3.7', 'Python 3.8', 'Python 3.9', 'Python 3.10']

    Metadata

    Metadata

    Assignees

    No one assigned

      Labels

      3.10only security fixes3.7 (EOL)end of life3.8 (EOL)end of life3.9only security fixesstdlibStandard Library Python modules in the Lib/ directorytype-securityA security issue

      Projects

      No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions