Vulnerability · Published Aug 22, 2023 · Assigned by mitre
CVE-2022-48564
Medium 6.5
In plain English
A medium-severity security flaw in the platform-python package (AlmaLinux). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.7% (higher than 77% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)6.5Medium
Exploit odds (30 days)1.7%top 23.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
read_ints in plistlib.py in Python through 3.9.1 is vulnerable to a potential DoS attack via CPU and RAM exhaustion when processing malformed Apple Property List files in binary format.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | platform-python | 3.6.8-56.el8_9.2.alma.1 | ALSA-2024:0114 |
| AlmaLinux:8 | platform-python-debug | 3.6.8-56.el8_9.2.alma.1 | ALSA-2024:0114 |
| AlmaLinux:8 | platform-python-devel | 3.6.8-56.el8_9.2.alma.1 | ALSA-2024:0114 |
| AlmaLinux:8 | python3-idle | 3.6.8-56.el8_9.2.alma.1 | ALSA-2024:0114 |
| AlmaLinux:8 | python3-libs | 3.6.8-56.el8_9.2.alma.1 | ALSA-2024:0114 |
| AlmaLinux:8 | python3-test | 3.6.8-56.el8_9.2.alma.1 | ALSA-2024:0114 |
| AlmaLinux:8 | python3-tkinter | 3.6.8-56.el8_9.2.alma.1 | ALSA-2024:0114 |
| Debian:12 | pypy3 | 7.3.5+dfsg-2 | DEBIAN-CVE-2022-48564 |
| Debian:13 | pypy3 | 7.3.5+dfsg-2 | DEBIAN-CVE-2022-48564 |
| Debian:14 | pypy3 | 7.3.5+dfsg-2 | DEBIAN-CVE-2022-48564 |
| Ubuntu:22.04:LTS | python3.10 | 3.10.12-1~22.04.4 | USN-6891-1 |