CriticalFix available
pypy3 — security advisory
An XML External Entity (XXE) issue was discovered in Python through 3.9.1. The plistlib module no longer accepts entity declarations in XML plist files to avoid XML vulnerabilities.
- Products
- pypy3
- Affected versions
- Not specified
- Fixed versions
- 7.3.5+dfsg-2
- CVEs
- CVE-2022-48565
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 30 Oct 2026, 15:03 UTC · Revision 1
Source evidence
An XML External Entity (XXE) issue was discovered in Python through 3.9.1. The plistlib module no longer accepts entity declarations in XML plist files to avoid XML vulnerabilities.
osv:DEBIAN-CVE-2022-48565
pypy3
Fixed versions: 7.3.5+dfsg-2
pypy3
Fixed versions: 7.3.5+dfsg-2
pypy3
Fixed versions: 7.3.5+dfsg-2
Complete source record
{
"id": "922692372e5ab6c53f18bc793f4d0f510440e112426370f9558ed4dea38b1256",
"url": "https://osv.dev/vulnerability/DEBIAN-CVE-2022-48565",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "DEBIAN-CVE-2022-48565",
"summary": "An XML External Entity (XXE) issue was discovered in Python through 3.9.1. The plistlib module no longer accepts entity declarations in XML plist files to avoid XML vulnerabilities.",
"evidence": "osv:DEBIAN-CVE-2022-48565",
"products": [
{
"name": {
"value": "pypy3",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "7.3.5+dfsg-2",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "pypy3",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "7.3.5+dfsg-2",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "pypy3",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "7.3.5+dfsg-2",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": []
}
],
"severity": "critical",
"structured": {
"id": "DEBIAN-CVE-2022-48565",
"aliases": [
"DEBIAN-CVE-2022-48565"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "7.3.5+dfsg-2"
}
]
}
],
"package": {
"name": "pypy3",
"purl": "pkg:deb/debian/pypy3?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2022-48565.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "7.3.5+dfsg-2"
}
]
}
],
"package": {
"name": "pypy3",
"purl": "pkg:deb/debian/pypy3?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2022-48565.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "7.3.5+dfsg-2"
}
]
}
],
"package": {
"name": "pypy3",
"purl": "pkg:deb/debian/pypy3?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2022-48565.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
],
"modified": "2026-10-15T08:02:47.203096515Z",
"provider": "osv",
"upstream": [
"CVE-2022-48565"
],
"references": [
"https://security-tracker.debian.org/tracker/CVE-2022-48565"
]
},
"related_cves": [
{
"value": "CVE-2022-48565",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 324240,
"published_at": "2023-08-22T19:16:32.007+00:00"
}