CVE-2022-48560: Use After Free
A use-after-free exists in Python through 3.9 via heappushpop in heapq.
Other sources
A use-after-free exists in Python via heappushpop in heapq module.
https://bugs.python.org/issue39421 https://github.com/python/cpython/issues/83602 https://github.com/python/cpython/commit/79f89e6e5a659846d1068e8b1bd8e491ccdef861 (v3.9.0a3) https://github.com/python/cpython/commit/993811ffe75c2573f97fb3fd1414b34609b8c8db (v3.8.2rc1) https://github.com/python/cpython/commit/958064f8d2b84062b0582bbae911df8ccfc11fd6 (v3.7.7rc1) https://github.com/python/cpython/commit/c563f409ea30bcb0623d785428c9257917371b76 (v3.6.11rc1)
— Red Hat
Python is vulnerable to a denial of service, caused by a use-after-free flaw in the heappushpop() function in the heapq module. By sending a specially crafted request, a local attacker could exploit this vulnerability to cause a denial of service condition.
— IBM
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2022-48560?
CVE-2022-48560 is a use-after-free vulnerability in Python through version 3.9.
How does the use-after-free vulnerability in Python CVE-2022-48560 occur?
The use-after-free vulnerability in Python CVE-2022-48560 occurs through the heappushpop function in the heapq module.
Which versions of Python are affected by CVE-2022-48560?
Python versions 3.7 to 3.9 are affected by CVE-2022-48560.
What is the severity of CVE-2022-48560?
CVE-2022-48560 has a severity rating of 7.5 (high).
How can I fix the use-after-free vulnerability in Python CVE-2022-48560?
To fix the use-after-free vulnerability in Python CVE-2022-48560, update to a version of Python that is not affected by the vulnerability.