DoS when reading malformed Apple Property List files in binary format

2023-08-2200:00:00

Google

osv.dev

dos attack

apple property list

binary format

python

software vulnerability

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

6.6 Medium

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

24.1%

JSON

read_ints in plistlib.py in Python through 3.9.1 is vulnerable to a potential DoS attack via CPU and RAM exhaustion when processing malformed Apple Property List files in binary format.

CPENameOperatorVersion
cpythoneq2.5a0
cpythoneq1.2b3
cpythoneq3.9.0
cpythoneq3.8.0b2
cpythoneq3.8.6rc1
cpythoneq3.5.0
cpythoneq3.9.0a5
cpythoneq3.8.3rc1
cpythoneq3.2.3rc1
cpythoneq2.7.3rc1

Name	Operator	Version
cpython	eq	2.5a0
cpython	eq	1.2b3
cpython	eq	3.9.0
cpython	eq	3.8.0b2
cpython	eq	3.8.6rc1
cpython	eq	3.5.0
cpython	eq	3.9.0a5
cpython	eq	3.8.3rc1
cpython	eq	3.2.3rc1
cpython	eq	2.7.3rc1