CVE-2022-48564

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2023-08-22 · updated 2026-06-17
Weakness: CWE-400

Description

read_ints in plistlib.py in Python through 3.9.1 is vulnerable to a potential DoS attack via CPU and RAM exhaustion when processing malformed Apple Property List files in binary format.

Affected products

Active IQ Unified Manager for VMware vSphere, Linux, and Microsoft Windows: all versions
Python: before 3.6.13; from 3.7.0 before 3.7.10; from 3.8.0 before 3.8.7; from 3.9.0 before 3.9.1 — fixed in 3.6.13, 3.7.10, 3.8.7, 3.9.1

How to fix

Upgrade to a fixed version: Python 3.6.13, 3.7.10, 3.8.7, 3.9.1. Check the vendor advisory for mitigations.

References

https://bugs.python.org/issue42103
https://lists.debian.org/debian-lts-announce/2023/10/msg00017.html
https://security.netapp.com/advisory/ntap-20230929-0009/
https://bugs.python.org/issue42103
https://lists.debian.org/debian-lts-announce/2023/10/msg00017.html
https://security.netapp.com/advisory/ntap-20230929-0009/

Get alerted when CVE-2022-48564 or the next vulnerability affects your stack