CVE-2022-48560 json
A use-after-free exists in Python through 3.9 via heappushpop in heapq.
published 2023-08-22 3 y ago modified 2026-11-02 6 d ago also BIT-libpython-2022-48560 , BIT-python-2022-48560 , BIT-python-min-2022-48560 , EUVD-2022-51256 , GHSA-pvw5-cvp6-cv92
- cvss
- 7.5
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 2.0%
- EPSS 2.0% chance of exploitation in 30 days, percentile 81%
- public exploits
- 0
- none known
Summary
A use-after-free exists in Python through 3.9 via heappushpop in heapq.
Patch / fix
- bitnami libpython 3.6.11, 3.7.7, 3.8.2
- bitnami python 3.6.11, 3.7.7, 3.8.2
- bitnami python-min 3.6.11, 3.7.7, 3.8.2
- Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5
- Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.5
- Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP V3.1.5
- python2.7 Debian 11 2.7.18-8+deb11u1
debian advisories DEBIAN-CVE-2022-48560
- python2.7 Ubuntu 20.04 LTS 2.7.18-1~20.04.7
- python2.7 Ubuntu 22.04 LTS 2.7.18-13ubuntu1.5
- python2.7 Ubuntu Pro 14.04 LTS 2.7.6-8ubuntu0.6+esm17
- python2.7 Ubuntu Pro 16.04 LTS 2.7.12-1ubuntu0~16.04.18+esm8
- python2.7 Ubuntu Pro 18.04 LTS 2.7.17-1~18.04ubuntu1.13+esm3
- python3.5 Ubuntu Pro 14.04 LTS 3.5.2-2ubuntu0~16.04.4~14.04.1+esm1
- python3.5 Ubuntu Pro 16.04 LTS 3.5.2-2ubuntu0~16.04.13+esm10
- python3.6 Ubuntu Pro 18.04 LTS 3.6.9-1~18.04ubuntu1.13+esm2
ubuntu advisories UBUNTU-CVE-2022-48560
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- pytz RHEL 8 2017.2-13.module+el8.9.0+19487+7dc18407
- babel RHEL 8 2.5.1-10.module+el8.9.0+19487+7dc18407
- numpy RHEL 8 1:1.14.2-16.module+el8.9.0+19487+7dc18407
- scipy RHEL 8 1.0.0-22.module+el8.9.0+19487+7dc18407
- Cython RHEL 8 0.28.1-7.module+el8.9.0+19487+7dc18407
- pytest RHEL 8 3.4.2-13.module+el8.9.0+19487+7dc18407
- PyYAML RHEL 8 3.12-16.module+el8.9.0+19487+7dc18407
- python2 RHEL 8 2.7.18-17.module+el8.10.0+20822+a15ec22d
red hat advisories RHSA-2024:2987RHSA-2024:0586RHSA-2024:0430RHSA-2024:0114
- python SLE Module for Package Hub 15 SP6, SLE Module for Package Hub 15 SP5, openSUSE Leap 15.6 +1 more 2.7.18-150000.65.1
- python-base SLE Module for Package Hub 15 SP6, SLE Module for Package Hub 15 SP5, openSUSE Leap 15.6 +1 more 2.7.18-150000.65.1
- python SLES for SAP 12 SP5, SLES 12 SP5 2.7.18-33.32.1
- python-base SLES for SAP 12 SP5, SLES 12 SP5, SLE Workstation Extension 12 SP5 2.7.18-33.32.1
suse advisories SUSE-SU-2024:1862-1SUSE-SU-2024:1667-1
- python openSUSE Tumbleweed 2.7.18-41.1
opensuse advisories openSUSE-SU-2024:13488-1
- babel AlmaLinux 8 2.5.1-10.module_el8.6.0+2781+fed64c13
- python2 AlmaLinux 8 2.7.18-17.module_el8.10.0+3783+2756348e.alma
- python2-py AlmaLinux 8 1.5.3-6.module_el8.6.0+2781+fed64c13
- python2-dns AlmaLinux 8 1.15.0-10.module_el8.6.0+2781+fed64c13
- python2-pip AlmaLinux 8 9.0.3-19.module_el8.6.0+2781+fed64c13
- python2-six AlmaLinux 8 1.11.0-6.module_el8.6.0+2781+fed64c13
- python2-bson AlmaLinux 8 3.7.0-1.module_el8.6.0+2781+fed64c13
- python2-bson AlmaLinux 8 3.7.0-1.module_el8.6.0+3162+01a09e5a
almalinux advisories ALSA-2024:2987ALSA-2024:0114
- pytz Rocky Linux 8 2017.2-13.module+el8.10.0+1817+0b01df83
- babel Rocky Linux 8 2.5.1-10.module+el8.9.0+1531+a18208f5
- numpy Rocky Linux 8 1:1.14.2-16.module+el8.9.0+1531+a18208f5
- scipy Rocky Linux 8 1.0.0-22.module+el8.10.0+1817+0b01df83
- Cython Rocky Linux 8 0.28.1-7.module+el8.9.0+1531+a18208f5
- pytest Rocky Linux 8 3.4.2-13.module+el8.9.0+1531+a18208f5
- PyYAML Rocky Linux 8 3.12-16.module+el8.9.0+1531+a18208f5
- python2 Rocky Linux 8 2.7.18-17.module+el8.10.0+1813+4b021305.rocky.0.2
rocky linux advisories RLSA-2024:2987
- bugs.python.org/issue39421 advisory
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2022-48560 updated cvss 7.5
python: use after free in heappushpop() of heapq module
-
Red Hat Enterprise Linux 6 python, tkinter, python-libs, python-test, python-tools Red Hat Enterprise Linux 7 python, python3, tkinter, python-libs, python-test, python-tools, +4 moreaffected: workaround, no fix planned “Out of support scope”
-
Red Hat Enterprise Linux 8 python2, python2-libs, python2-test, python2-tools, python2-tkinteraffected: workaround, no fix available, no fix planned “Will not fix”
-
Red Hat Enterprise Linux AppStream (v. 8) python3-idle 3.6.8-56.el8_9.2, python3-test 3.6.8-56.el8_9.2, platform-python 3.6.8-56.el8_9.2, python3-tkinter 3.6.8-56.el8_9.2, babel 2.5.1-10.module+el8.9.0+19487+7dc18407, pytz 2017.2-13.module+el8.9.0+19487+7dc18407, +87 morefixed: vendor fix RHSA-2024:2987
-
Red Hat Enterprise Linux AppStream EUS (v.8.6) python3-idle 3.6.8-47.el8_6.4, python3-test 3.6.8-47.el8_6.4, platform-python 3.6.8-47.el8_6.4, python3-tkinter 3.6.8-47.el8_6.4fixed: vendor fix RHSA-2024:0430
-
Red Hat Enterprise Linux AppStream EUS (v.8.8) python3-idle 3.6.8-51.el8_8.4, python3-test 3.6.8-51.el8_8.4, platform-python 3.6.8-51.el8_8.4, python3-tkinter 3.6.8-51.el8_8.4fixed: vendor fix RHSA-2024:0586
-
Red Hat Enterprise Linux BaseOS (v. 8) python3 3.6.8-56.el8_9.2, python3-libs 3.6.8-56.el8_9.2, python3-test 3.6.8-56.el8_9.2, platform-python 3.6.8-56.el8_9.2fixed: vendor fix RHSA-2024:0114
-
Red Hat Enterprise Linux BaseOS EUS (v.8.6) python3 3.6.8-47.el8_6.4, python3-libs 3.6.8-47.el8_6.4, python3-test 3.6.8-47.el8_6.4, platform-python 3.6.8-47.el8_6.4fixed: vendor fix RHSA-2024:0430
-
Red Hat Enterprise Linux BaseOS EUS (v.8.8) python3 3.6.8-51.el8_8.4, python3-libs 3.6.8-51.el8_8.4, python3-test 3.6.8-51.el8_8.4, platform-python 3.6.8-51.el8_8.4fixed: vendor fix RHSA-2024:0586
show 1 moreshow fewer
-
Red Hat Enterprise Linux 8 numpy, scipy, PyYAML, mod_wsgi, python36, python39, +77 more Red Hat Enterprise Linux 9 python3, python3.9, python3.11, python3-idle, python3-libs, python3-test, +6 more Red Hat Software Collections rh-python38-python, rh-python38-python-idle, rh-python38-python-libs, rh-python38-python-test, rh-python38-python-tkinter, rh-python38-python-rpm-macros, +1 morenot affected: vulnerable code not present
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
cisa ICSA-23-348-10 updated cvss 7.5
Siemens SIMATIC S7-1500
-
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0) >= 3.1.0, < 3.1.5 Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0) >= 3.1.0, < 3.1.5 Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0) >= 3.1.0, < 3.1.5 Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0) >= 3.1.0, < 3.1.5 Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0) >= 3.1.0, < 3.1.5affected: fixed in V3.1.5, mitigation support.industry.siemens.com
Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 6 d ago
Exploit prediction
2.04% chance of exploitation in the next 30 days, higher than 81% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- bugs.python.org https://bugs.python.org/issue39421 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| OSV | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| bitnami | libpython | <3.6.11 >=3.7.0, <3.7.7 >=3.8.0, <3.8.2 |
3.6.11 3.7.7 3.8.2 |
| bitnami | python | <3.6.11 >=3.7.0, <3.7.7 >=3.8.0, <3.8.2 |
3.6.11 3.7.7 3.8.2 |
| bitnami | python-min | <3.6.11 >=3.7.0, <3.7.7 >=3.8.0, <3.8.2 |
3.6.11 3.7.7 3.8.2 |
Affected products
- Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
- Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP
- Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP
Classification
- Weakness
-
- CWE-416 Use After Free
References
-
bugs.python.org
/issue39421
exploit, issue-tracking, patch, vendor-advisory, advisory
-
lists.fedoraproject.org
/archives/list/package-announce%40lists.fedoraproject.org/message/VO7Y2YZSDK3UYJD2KBGLXRTGNG6T326J/
vendor-advisory, web
-
lists.fedoraproject.org
/archives/list/package-announce%40lists.fedoraproject.org/message/JZ5OOBWNYWXFTZDMCGHJVGDLDTHLWITJ/
vendor-advisory, web
-
lists.debian.org
/debian-lts-announce/2023/09/msg00022.html
mailing-list, third-party-advisory, advisory
-
security.netapp.com
/advisory/ntap-20230929-0008/
web
-
lists.debian.org
/debian-lts-announce/2023/10/msg00017.html
mailing-list, web
-
lists.fedoraproject.org
/archives/list/package-announce@lists.fedoraproject.org/message/JZ5OOBWNYWXFTZDMCGHJVGDLDTHLWITJ/
web
-
lists.fedoraproject.org
/archives/list/package-announce@lists.fedoraproject.org/message/VO7Y2YZSDK3UYJD2KBGLXRTGNG6T326J/
web
- cert-portal.siemens.com /productcert/html/ssa-398330.html
-
nvd.nist.gov
/vuln/detail/CVE-2022-48560
web
Sources
- CVE List CVE-2022-48560
- NVD CVE-2022-48560
- OSV BIT-libpython-2022-48560
- OSV BIT-python-2022-48560
- OSV BIT-python-min-2022-48560
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.