Critical DoS Vulnerability in Python Packages: CVE-2022-48564
Summary
UBUNTU-CVE-2022-48564: read_ints in plistlib.py in Python through 3.9.1 is vulnerable to a potential DoS attack via CPU and RAM exhaustion when processing malformed Apple Property List files in binary format. Affects python2.7 versions < 2.7.6-8ubuntu0.6+esm18. Fixed in 2.7.6-8ubuntu0.6+esm18. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python is a widely-used high-level programming language known for its readability and versatility. It supports multiple programming paradigms and is extensively used in web development, data analysis, artificial intelligence, and more. The vulnerability CVE-2022-48564 affects several Python packages, including python2.7, python3.4, python3.5, python3.6, python3.7, and python3.8, which are essential for running Python applications on Ubuntu systems. This vulnerability can lead to denial of service (DoS) attacks, impacting the availability of applications relying on these packages.
Vulnerability Detail
The vulnerability arises from the function read_ints in plistlib.py in Python versions up to 3.9.1. It is susceptible to a potential DoS attack via CPU and RAM exhaustion when processing malformed Apple Property List files in binary format. Attackers can exploit this vulnerability by crafting malicious files that, when processed, consume excessive system resources, leading to degraded performance or complete unavailability of the affected application.
How To Fix
Minimum fixed version
2.7.6-8ubuntu0.6+esm18
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python2.7Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not feasible, consider implementing input validation to filter out potentially malicious Apple Property List files before processing them. This can help mitigate the risk of exploitation until the packages are updated.
Conclusion
CVE-2022-48564 is a significant vulnerability affecting multiple Python packages that can lead to denial of service attacks. It is crucial to update the affected packages to their patched versions to mitigate the risk. Users should also consider implementing workarounds until updates can be applied.
See every vulnerability recorded for python2.7 →
FAQ
CVE-2022-48564 is a vulnerability in Python's plistlib.py that can lead to denial of service (DoS) attacks through CPU and RAM exhaustion when processing malformed Apple Property List files.
The affected packages include python2.7, python3.4, python3.5, python3.6, python3.7, and python3.8 across various Ubuntu distributions.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application using the Vulert playground without any signup at Vulert Scanner.
The CVSS score for CVE-2022-48564 is 6.5, indicating a medium severity level.
Implement input validation to filter out potentially malicious files until you can update the affected packages.
Related vulnerabilities
Recent vulnerabilities recorded for python2.7.
