An XML External Entity (XXE) issue was discovered in Python through 3.9.1. The plistlib module no longer accepts entity declarations in XML plist files to avoid XML vulnerabilities.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade python2-setuptools-wheelUpgrade python2-mockUpgrade python2-wheelUpgrade python2-pyyamlUpgrade python2-scipyUpgrade python2-CythonUpgrade python2-noseUpgrade babelUpgrade python2-develUpgrade python2-docutilsUpgrade python2-babelUpgrade python2-docsUpgrade python2-funcsigsUpgrade python2-pytestUpgrade python2-bsonUpgrade python2-dnsUpgrade python2-pipUpgrade python2-sqlalchemyUpgrade python2-rpm-macrosUpgrade python-nose-docsUpgrade python2-pluggyUpgrade python2-PyMySQLUpgrade python2-psycopg2-testsUpgrade python2-coverageUpgrade python2-ipaddressUpgrade python2-debugUpgrade python2-psycopg2Upgrade python2-toolsUpgrade python2-pytest-mockUpgrade python2-virtualenvUpgrade python2-libsUpgrade python2-jinja2Upgrade python2-pygmentsUpgrade python2-pymongo-gridfsUpgrade python2-numpy-docUpgrade python2-idnaUpgrade python2-setuptoolsUpgrade python2-numpy-f2pyUpgrade python2-numpyUpgrade python2-pysocksUpgrade python2-requestsUpgrade python2-setuptools_scmUpgrade python2-docs-infoUpgrade python-psycopg2-docUpgrade python2-pymongoUpgrade python2-sixUpgrade python2-pytzUpgrade python2-attrsUpgrade python2-pyUpgrade python2-pip-wheelUpgrade python2-markupsafeUpgrade python2-testUpgrade python2-backports-ssl_match_hostnameUpgrade python2-backportsUpgrade python2-lxmlUpgrade python2Upgrade python2-tkinterUpgrade python2-wheel-wheelUpgrade python2-urllib3Upgrade python2-chardetUpgrade python2-psycopg2-debugUpgrade python-sqlalchemy-doc | May 31, 2024 | Aug 22, 2023 |
| Amazon Linux Ami 2 | — | Upgrade python-libsUpgrade python-debugUpgrade python-develUpgrade python3-testUpgrade python3-debugUpgrade python-debuginfoUpgrade python-testUpgrade python3-tkinterUpgrade python-toolsUpgrade python3-toolsUpgrade tkinterUpgrade python3-libsUpgrade pythonUpgrade python3-debuginfoUpgrade python3Upgrade python3-devel | Oct 27, 2023 | Aug 22, 2023 |
| Amazon_linux | — | Upgrade python27 | Nov 4, 2023 | Aug 22, 2023 |
| Debian | — | Upgrade python3.9Upgrade python2.7Upgrade pypy3 | Sep 22, 2023 | Aug 22, 2023 |
| F5 Big Ip | — | — | May 23, 2024 | Sep 18, 2018 |
| Huawei Euleros 2_0_sp5 | — | Upgrade tkinterUpgrade pythonUpgrade python-libsUpgrade python-devel | Feb 12, 2024 | Aug 22, 2023 |
| Huawei Euleros 2_0_sp8 | — | Upgrade python3-testUpgrade python3Upgrade python3-develUpgrade python3-unversioned-commandUpgrade python3-libs | Mar 13, 2024 | Aug 22, 2023 |
| Oracle_linux | — | Upgrade python-nose-docsUpgrade python2-numpy-f2pyUpgrade python2-testUpgrade python2-bsonUpgrade python2-sixUpgrade python2-dnsUpgrade python2-mockUpgrade python2Upgrade python2-pysocksUpgrade python-psycopg2-docUpgrade python2-backports-ssl_match_hostnameUpgrade python2-setuptools-wheelUpgrade python2-psycopg2-debugUpgrade python2-psycopg2-testsUpgrade python2-debugUpgrade python2-pymongo-gridfsUpgrade python2-pytestUpgrade python2-attrsUpgrade python2-docsUpgrade python2-wheel-wheelUpgrade python2-psycopg2Upgrade python2-urllib3Upgrade python2-pipUpgrade python2-coverageUpgrade python2-rpm-macrosUpgrade python2-wheelUpgrade python2-pyyamlUpgrade python2-pymongoUpgrade python2-setuptools_scmUpgrade python2-docs-infoUpgrade python2-pyUpgrade python2-noseUpgrade python2-develUpgrade python2-jinja2Upgrade python2-ipaddressUpgrade python2-sqlalchemyUpgrade python2-docutilsUpgrade python2-tkinterUpgrade python2-PyMySQLUpgrade python2-numpy-docUpgrade python2-babelUpgrade python2-pytest-mockUpgrade python2-pip-wheelUpgrade python2-numpyUpgrade python2-markupsafeUpgrade python2-scipyUpgrade python2-virtualenvUpgrade python2-toolsUpgrade python2-pytzUpgrade python2-lxmlUpgrade babelUpgrade python2-setuptoolsUpgrade python2-libsUpgrade python2-idnaUpgrade python2-funcsigsUpgrade python2-backportsUpgrade python2-requestsUpgrade python2-pluggyUpgrade python2-CythonUpgrade python2-pygmentsUpgrade python2-chardetUpgrade python-sqlalchemy-doc | May 28, 2024 | Aug 22, 2023 |
| Redhat_linux | — | Upgrade python2-urllib3Upgrade python2-babelUpgrade python2-wheelUpgrade python2-backports-ssl_match_hostnameUpgrade python2-psycopg2-debugUpgrade python2-setuptools_scmUpgrade python2-pymongo-gridfsUpgrade python-psycopg2-docUpgrade python2-lxmlUpgrade python2-chardetUpgrade python2-numpy-f2pyUpgrade python2-pysocksUpgrade python2-pytzUpgrade python2-idnaUpgrade python2-markupsafeUpgrade python2-coverage-debuginfoUpgrade python-sqlalchemy-docUpgrade python2-pygmentsUpgrade python2-mockUpgrade scipy-debugsourceUpgrade python2-psycopg2-debuginfoUpgrade python2-rpm-macrosUpgrade python2-requestsUpgrade python2-pipNo solution existsUpgrade python2-debuginfoUpgrade python2-sixUpgrade python2-attrsUpgrade python2Upgrade python2-backportsUpgrade python2-testUpgrade python2-setuptoolsUpgrade python2-pymongoUpgrade python2-lxml-debuginfoUpgrade python2-numpy-docUpgrade python2-wheel-wheelUpgrade python-psycopg2-debugsourceUpgrade python2-tkinterUpgrade python-pymongo-debugsourceUpgrade python2-pluggyUpgrade python2-jinja2Upgrade numpy-debugsourceUpgrade python2-PyMySQLUpgrade python2-numpy-debuginfoUpgrade python2-docutilsUpgrade python2-psycopg2-debug-debuginfoUpgrade python2-scipy-debuginfoUpgrade python2-psycopg2-testsUpgrade python2-numpyUpgrade python2-docs-infoUpgrade python2-debugUpgrade python2-pip-wheelUpgrade python2-sqlalchemyUpgrade python2-pytestUpgrade python-coverage-debugsourceUpgrade python2-funcsigsUpgrade python2-libsUpgrade python2-Cython-debuginfoUpgrade python2-develUpgrade python2-docsUpgrade python2-coverageUpgrade python2-pyUpgrade python-psycopg2-debuginfoUpgrade python2-noseUpgrade python2-pyyamlUpgrade python2-pymongo-debuginfoUpgrade babelUpgrade python2-dnsUpgrade python2-ipaddressUpgrade python2-debugsourceUpgrade python2-scipyUpgrade python2-psycopg2Upgrade python2-toolsUpgrade PyYAML-debugsourceUpgrade python2-setuptools-wheelUpgrade python2-bsonUpgrade python-nose-docsUpgrade python2-bson-debuginfoUpgrade python2-virtualenvUpgrade python-pymongo-debuginfoUpgrade python2-CythonUpgrade python2-pyyaml-debuginfoUpgrade python-lxml-debugsourceUpgrade Cython-debugsourceUpgrade python2-pytest-mock | May 23, 2024 | Aug 22, 2023 |
| Rocky_linux | — | Upgrade python2-markupsafeUpgrade python2-pymongo-gridfsUpgrade python2-tkinterUpgrade scipy-debugsourceUpgrade python2-debuginfoUpgrade python2-psycopg2-debug-debuginfoUpgrade python2-numpy-debuginfoUpgrade Cython-debugsourceUpgrade python2-bsonUpgrade python-coverage-debugsourceUpgrade python2-debugUpgrade python2-debugsourceUpgrade python2-toolsUpgrade python-psycopg2-debugsourceUpgrade python2-lxmlUpgrade python2-scipyUpgrade python2-psycopg2Upgrade python2-sqlalchemyUpgrade python2-pymongo-debuginfoUpgrade python2-testUpgrade python2-coverageUpgrade python2-libsUpgrade python2-psycopg2-debugUpgrade python2-CythonUpgrade python-pymongo-debuginfoUpgrade python2-develUpgrade python2Upgrade python2-bson-debuginfoUpgrade python2-psycopg2-testsUpgrade numpy-debugsourceUpgrade python2-pyyaml-debuginfoUpgrade python2-scipy-debuginfoUpgrade python2-Cython-debuginfoUpgrade python-pymongo-debugsourceUpgrade python-psycopg2-debuginfoUpgrade python2-numpyUpgrade python2-psycopg2-debuginfoUpgrade python-psycopg2-docUpgrade python-lxml-debugsourceUpgrade PyYAML-debugsourceUpgrade python2-coverage-debuginfoUpgrade python2-pymongoUpgrade python2-pyyamlUpgrade python2-numpy-f2pyUpgrade python2-lxml-debuginfoUpgrade python2-backports | May 8, 2025 | Aug 22, 2023 |
| Suse | — | Upgrade python-xmlUpgrade python-develUpgrade python-cursesUpgrade python-base-32bitUpgrade python-gdbmUpgrade python-tkUpgrade python-idleUpgrade python-baseUpgrade libpython2_7-1_0-32bitUpgrade python-docUpgrade libpython2_7-1_0Upgrade pythonUpgrade python-doc-pdfUpgrade python-32bitUpgrade python-demo | Oct 10, 2023 | Aug 22, 2023 |
| Ubuntu | — | Upgrade python3.8 (Ubuntu Pro)Upgrade libpython2.7-stdlib (Ubuntu Pro)Upgrade python3.7-minimal (Ubuntu Pro)Upgrade libpython3.5 (Ubuntu Pro)Upgrade python3.5-minimal (Ubuntu Pro)Upgrade python3.6 (Ubuntu Pro)Upgrade python3.8-minimal (Ubuntu Pro)Upgrade python2.7 (Ubuntu Pro)Upgrade python2.7Upgrade python2.7-minimal (Ubuntu Pro)Upgrade python3.6-minimal (Ubuntu Pro)Upgrade libpython2.7 (Ubuntu Pro)Upgrade python3.5 (Ubuntu Pro)Upgrade python3.7 (Ubuntu Pro)Upgrade libpython3.5-stdlib (Ubuntu Pro) | Sep 18, 2023 | Aug 22, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Aug 22, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub