CVE-2022-48564

read_ints in plistlib.py in Python through 3.9.1 is vulnerable to a potential DoS attack via CPU and RAM exhaustion when processing malformed Apple Property List files in binary format.

References

Affected packages

Debian:11 / pypy3

Package

Name: pypy3
Purl: pkg:deb/debian/pypy3?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

7.3.5+dfsg-2

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:12 / pypy3

Package

Name: pypy3
Purl: pkg:deb/debian/pypy3?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

7.3.5+dfsg-2

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:13 / pypy3

Package

Name: pypy3
Purl: pkg:deb/debian/pypy3?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

7.3.5+dfsg-2

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:11 / python3.9

Package

Name: python3.9
Purl: pkg:deb/debian/python3.9?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

3.9.1~rc1-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Git / github.com/python/cpython

Affected ranges

Type: GIT
Repo: https://github.com/python/cpython
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

aa73e1722eb9835dc99fd8983885a141112ee4ab