CVE-2022-48560: Use After Free
A use-after-free exists in Python through 3.9 via heappushpop in heapq.
Other sources
A use-after-free exists in Python via heappushpop in heapq module.
https://bugs.python.org/issue39421 https://github.com/python/cpython/issues/83602 https://github.com/python/cpython/commit/79f89e6e5a659846d1068e8b1bd8e491ccdef861 (v3.9.0a3) https://github.com/python/cpython/commit/993811ffe75c2573f97fb3fd1414b34609b8c8db (v3.8.2rc1) https://github.com/python/cpython/commit/958064f8d2b84062b0582bbae911df8ccfc11fd6 (v3.7.7rc1) https://github.com/python/cpython/commit/c563f409ea30bcb0623d785428c9257917371b76 (v3.6.11rc1)
— Red Hat
Python is vulnerable to a denial of service, caused by a use-after-free flaw in the heappushpop() function in the heapq module. By sending a specially crafted request, a local attacker could exploit this vulnerability to cause a denial of service condition.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/pythonto a version that resolves this vulnerability.Fixed in 3.9.0 - Upgrade
Upgrade
redhat/pythonto a version that resolves this vulnerability.Fixed in 3.8.2 - Upgrade
Upgrade
redhat/pythonto a version that resolves this vulnerability.Fixed in 3.7.7 - Upgrade
Upgrade
redhat/pythonto a version that resolves this vulnerability.Fixed in 3.6.11 - Upgrade
Upgrade
debian/python2.7to a version that resolves this vulnerability.Fixed in 2.7.18-8+deb11u1 - Upgrade
Upgrade
debian/python3.9to a version that resolves this vulnerability.Fixed in 3.9.2-1Fixed in 3.9.2-1+deb11u3 - Upgrade
Upgrade
Pythonto a version that resolves this vulnerability.Fixed in 3.9.0a3 - Upgrade
Upgrade
Pythonto a version that resolves this vulnerability.Fixed in 3.8.2rc1 - Upgrade
Upgrade
Pythonto a version that resolves this vulnerability.Fixed in 3.7.7rc1 - Upgrade
Upgrade
Pythonto a version that resolves this vulnerability.Fixed in 3.6.11rc1
Event History
Frequently Asked Questions
What is CVE-2022-48560?
CVE-2022-48560 is a use-after-free vulnerability in Python through version 3.9.
How does the use-after-free vulnerability in Python CVE-2022-48560 occur?
The use-after-free vulnerability in Python CVE-2022-48560 occurs through the heappushpop function in the heapq module.
Which versions of Python are affected by CVE-2022-48560?
Python versions 3.7 to 3.9 are affected by CVE-2022-48560.
What is the severity of CVE-2022-48560?
CVE-2022-48560 has a severity rating of 7.5 (high).
How can I fix the use-after-free vulnerability in Python CVE-2022-48560?
To fix the use-after-free vulnerability in Python CVE-2022-48560, update to a version of Python that is not affected by the vulnerability.