synced 13 MIN AGO
01 Record

CVE-2022-48560

A use-after-free exists in Python through 3.9 via heappushpop in heapq.

UnratedPUBLISHEDCNA: mitre
CNA base scoreUnratedNo CNA CVSS vector
View raw JSON

02 Description

A use-after-free exists in Python through 3.9 via heappushpop in heapq.

03 Exploitation and scoring

Exploitation
Not assessed. CISA has not published an exploitation assessment for this record, and it is not in the KEV catalog. That is an absence of assessment, not a finding of no risk.
SSVC decision
Not assessed by CISA
EPSS probability
2.04% probability of exploitation activity in the next 30 days.
EPSS percentile
Equal to or higher than the score of 80.7% of scored records. A rank, not a probability.
NVD base score
7.5 (CVSS v3.x), scored by the NVD independently of the CNA.
NVD CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD analysis status
Modified. NVD last modified this record on 2026-10-14.
Red Hat severity
Moderate. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published
2023-08-22 00:00Z3 YR AGO
Last updated
2026-10-14 18:44Z14 DAYS AGO
Reserved
2023-07-23
Assigning CNA
mitre
Record state
PUBLISHED
Severity
Not rated by the issuing CNA
CNA CVSS vector
Not published by the issuing CNA
Weaknesses
Data version
5.2
Document digest
32978262dd6a414d3f993c042408703a9ebf7e0707177c22fbf6f079f39902f4

05 Affected products

VendorProductVersionsPlatforms
debiandebian_linuxNot specified—
pythonpythonNot specified—
redhatenterprise_linuxNot specified—
redhatrhel_eusNot specified—
redhatrhel_software_collectionsNot specified—

06 References

07 Fixed in

AlmaLinux 8

  • babel
    Fixed in 2.5.1-10.module_el8.6.0+2781+fed64c13
  • platform-python
    Fixed in 3.6.8-56.el8_9.2.alma.1
  • platform-python-debug
    Fixed in 3.6.8-56.el8_9.2.alma.1
  • platform-python-devel
    Fixed in 3.6.8-56.el8_9.2.alma.1
  • python-nose-docs
    Fixed in 1.3.7-31.module_el8.6.0+2781+fed64c13
  • python-psycopg2-doc
    Fixed in 2.7.5-8.module_el8.9.0+3640+8d3927b5
  • python-sqlalchemy-doc
    Fixed in 1.3.2-2.module_el8.6.0+2781+fed64c13
  • python2
    Fixed in 2.7.18-17.module_el8.10.0+3783+2756348e.alma
  • python2-Cython
    Fixed

    A version is affected if any line below covers it.

    • Affected before 0.28.1-7.module_el8.6.0+2781+fed64c13
    • Affected before 0.28.1-7.module_el8.6.0+3162+01a09e5a
  • python2-PyMySQL
    Fixed in 0.8.0-10.module_el8.6.0+2781+fed64c13
  • python2-attrs
    Fixed in 17.4.0-10.module_el8.6.0+2781+fed64c13
  • python2-babel
    Fixed in 2.5.1-10.module_el8.6.0+2781+fed64c13
  • python2-backports
    Fixed

    A version is affected if any line below covers it.

    • Affected before 1.0-16.module_el8.6.0+2781+fed64c13
    • Affected before 1.0-16.module_el8.6.0+3162+01a09e5a
  • python2-backports-ssl_match_hostname
    Fixed in 3.5.0.1-12.module_el8.6.0+2781+fed64c13
  • python2-bson
    Fixed

    A version is affected if any line below covers it.

    • Affected before 3.7.0-1.module_el8.6.0+2781+fed64c13
    • Affected before 3.7.0-1.module_el8.6.0+3162+01a09e5a
  • python2-chardet
    Fixed in 3.0.4-10.module_el8.6.0+2781+fed64c13
  • python2-coverage
    Fixed in 4.5.1-5.module_el8.9.0+3640+8d3927b5
  • python2-debug
    Fixed in 2.7.18-17.module_el8.10.0+3783+2756348e.alma
  • python2-devel
    Fixed in 2.7.18-17.module_el8.10.0+3783+2756348e.alma
  • python2-dns
    Fixed in 1.15.0-10.module_el8.6.0+2781+fed64c13
  • python2-docs
    Fixed in 2.7.16-2.module_el8.6.0+2781+fed64c13
  • python2-docs-info
    Fixed in 2.7.16-2.module_el8.6.0+2781+fed64c13
  • python2-docutils
    Fixed in 0.14-12.module_el8.6.0+2781+fed64c13
  • python2-funcsigs
    Fixed in 1.0.2-13.module_el8.6.0+2781+fed64c13
  • python2-idna
    Fixed in 2.5-7.module_el8.6.0+2781+fed64c13
  • python2-ipaddress
    Fixed in 1.0.18-6.module_el8.6.0+2781+fed64c13
  • python2-jinja2
    Fixed in 2.10-10.module_el8.10.0+3783+2756348e
  • python2-libs
    Fixed in 2.7.18-17.module_el8.10.0+3783+2756348e.alma
  • python2-lxml
    Fixed

    A version is affected if any line below covers it.

    • Affected before 4.2.3-6.module_el8.6.0+2781+fed64c13
    • Affected before 4.2.3-6.module_el8.6.0+3162+01a09e5a
  • python2-markupsafe
    Fixed

    A version is affected if any line below covers it.

    • Affected before 0.23-19.module_el8.6.0+2781+fed64c13
    • Affected before 0.23-19.module_el8.6.0+3162+01a09e5a
  • python2-mock
    Fixed in 2.0.0-13.module_el8.6.0+2781+fed64c13
  • python2-nose
    Fixed in 1.3.7-31.module_el8.6.0+2781+fed64c13
  • python2-numpy
    Fixed

    A version is affected if any line below covers it.

    • Affected before 1:1.14.2-16.module_el8.6.0+2781+fed64c13
    • Affected before 1:1.14.2-16.module_el8.6.0+3162+01a09e5a
  • python2-numpy-doc
    Fixed in 1:1.14.2-16.module_el8.6.0+2781+fed64c13
  • python2-numpy-f2py
    Fixed

    A version is affected if any line below covers it.

    • Affected before 1:1.14.2-16.module_el8.6.0+2781+fed64c13
    • Affected before 1:1.14.2-16.module_el8.6.0+3162+01a09e5a
  • python2-pip
    Fixed in 9.0.3-19.module_el8.6.0+2781+fed64c13
  • python2-pip-wheel
    Fixed in 9.0.3-19.module_el8.6.0+2781+fed64c13
  • python2-pluggy
    Fixed in 0.6.0-8.module_el8.6.0+2781+fed64c13
  • python2-psycopg2
    Fixed in 2.7.5-8.module_el8.9.0+3640+8d3927b5
  • python2-psycopg2-debug
    Fixed in 2.7.5-8.module_el8.9.0+3640+8d3927b5

29 further packages in AlmaLinux 8 not shown (first 40 listed).

Source: AlmaLinux, AlmaLinux OS. Copyright (c) 2023 AlmaLinux OS. Licensed under MIT License. Received through OSV.dev. Reformatted by exploit.cc.

CloudLinux 8

  • babel
    Fixed in 2.5.1-10.module_el8.6.0+2781+fed64c13
  • platform-python
    Fixed in 3.6.8-56.el8_9.2.alma.1
  • platform-python-debug
    Fixed in 3.6.8-56.el8_9.2.alma.1
  • platform-python-devel
    Fixed in 3.6.8-56.el8_9.2.alma.1
  • python-nose-docs
    Fixed in 1.3.7-31.module_el8.6.0+2781+fed64c13
  • python-psycopg2-doc
    Fixed in 2.7.5-8.module_el8.9.0+3640+8d3927b5
  • python-sqlalchemy-doc
    Fixed in 1.3.2-2.module_el8.6.0+2781+fed64c13
  • python2
    Fixed in 2.7.18-17.module_el8.10.0+3783+2756348e.alma
  • python2-Cython
    Fixed

    A version is affected if any line below covers it.

    • Affected before 0.28.1-7.module_el8.6.0+2781+fed64c13
    • Affected before 0.28.1-7.module_el8.6.0+3162+01a09e5a
  • python2-PyMySQL
    Fixed in 0.8.0-10.module_el8.6.0+2781+fed64c13
  • python2-attrs
    Fixed in 17.4.0-10.module_el8.6.0+2781+fed64c13
  • python2-babel
    Fixed in 2.5.1-10.module_el8.6.0+2781+fed64c13
  • python2-backports
    Fixed

    A version is affected if any line below covers it.

    • Affected before 1.0-16.module_el8.6.0+2781+fed64c13
    • Affected before 1.0-16.module_el8.6.0+3162+01a09e5a
  • python2-backports-ssl_match_hostname
    Fixed in 3.5.0.1-12.module_el8.6.0+2781+fed64c13
  • python2-bson
    Fixed

    A version is affected if any line below covers it.

    • Affected before 3.7.0-1.module_el8.6.0+2781+fed64c13
    • Affected before 3.7.0-1.module_el8.6.0+3162+01a09e5a
  • python2-chardet
    Fixed in 3.0.4-10.module_el8.6.0+2781+fed64c13
  • python2-coverage
    Fixed in 4.5.1-5.module_el8.9.0+3640+8d3927b5
  • python2-debug
    Fixed in 2.7.18-17.module_el8.10.0+3783+2756348e.alma
  • python2-devel
    Fixed in 2.7.18-17.module_el8.10.0+3783+2756348e.alma
  • python2-dns
    Fixed in 1.15.0-10.module_el8.6.0+2781+fed64c13
  • python2-docs
    Fixed in 2.7.16-2.module_el8.6.0+2781+fed64c13
  • python2-docs-info
    Fixed in 2.7.16-2.module_el8.6.0+2781+fed64c13
  • python2-docutils
    Fixed in 0.14-12.module_el8.6.0+2781+fed64c13
  • python2-funcsigs
    Fixed in 1.0.2-13.module_el8.6.0+2781+fed64c13
  • python2-idna
    Fixed in 2.5-7.module_el8.6.0+2781+fed64c13
  • python2-ipaddress
    Fixed in 1.0.18-6.module_el8.6.0+2781+fed64c13
  • python2-jinja2
    Fixed in 2.10-10.module_el8.10.0+3783+2756348e
  • python2-libs
    Fixed in 2.7.18-17.module_el8.10.0+3783+2756348e.alma
  • python2-lxml
    Fixed

    A version is affected if any line below covers it.

    • Affected before 4.2.3-6.module_el8.6.0+2781+fed64c13
    • Affected before 4.2.3-6.module_el8.6.0+3162+01a09e5a
  • python2-markupsafe
    Fixed

    A version is affected if any line below covers it.

    • Affected before 0.23-19.module_el8.6.0+2781+fed64c13
    • Affected before 0.23-19.module_el8.6.0+3162+01a09e5a
  • python2-mock
    Fixed in 2.0.0-13.module_el8.6.0+2781+fed64c13
  • python2-nose
    Fixed in 1.3.7-31.module_el8.6.0+2781+fed64c13
  • python2-numpy
    Fixed

    A version is affected if any line below covers it.

    • Affected before 1:1.14.2-16.module_el8.6.0+2781+fed64c13
    • Affected before 1:1.14.2-16.module_el8.6.0+3162+01a09e5a
  • python2-numpy-doc
    Fixed in 1:1.14.2-16.module_el8.6.0+2781+fed64c13
  • python2-numpy-f2py
    Fixed

    A version is affected if any line below covers it.

    • Affected before 1:1.14.2-16.module_el8.6.0+2781+fed64c13
    • Affected before 1:1.14.2-16.module_el8.6.0+3162+01a09e5a
  • python2-pip
    Fixed in 9.0.3-19.module_el8.6.0+2781+fed64c13
  • python2-pip-wheel
    Fixed in 9.0.3-19.module_el8.6.0+2781+fed64c13
  • python2-pluggy
    Fixed in 0.6.0-8.module_el8.6.0+2781+fed64c13
  • python2-psycopg2
    Fixed in 2.7.5-8.module_el8.9.0+3640+8d3927b5
  • python2-psycopg2-debug
    Fixed in 2.7.5-8.module_el8.9.0+3640+8d3927b5

29 further packages in CloudLinux 8 not shown (first 40 listed).

Derived from AlmaLinux 8. Partial coverage: only packages taken from AlmaLinux 8 are listed.

Source: CloudLinux errata, CloudLinux Inc. Derived from: AlmaLinux, AlmaLinux OS. Copyright (c) 2023 AlmaLinux OS. Licensed under MIT License. Received through OSV.dev. Reformatted by exploit.cc.

Debian 11

  • python2.7
    Fixed in 2.7.18-8+deb11u1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Ubuntu 20.04 LTS

  • python2.7
    Fixed in 2.7.18-1~20.04.7

Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.

Ubuntu 22.04 LTS

  • python2.7
    Fixed in 2.7.18-13ubuntu1.5

Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.

Ubuntu Pro 14.04 LTS

  • python2.7
    Fixed in 2.7.6-8ubuntu0.6+esm17
    Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro
  • python3.4
    No fix yet
  • python3.5
    Fixed in 3.5.2-2ubuntu0~16.04.4~14.04.1+esm1
    Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro

Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.

Ubuntu Pro 16.04 LTS

  • python2.7
    Fixed in 2.7.12-1ubuntu0~16.04.18+esm8
    Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro
  • python3.5
    Fixed in 3.5.2-2ubuntu0~16.04.13+esm10
    Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro

Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.

Ubuntu Pro 18.04 LTS

  • python2.7
    Fixed in 2.7.17-1~18.04ubuntu1.13+esm3
    Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro
  • python3.6
    Fixed in 3.6.9-1~18.04ubuntu1.13+esm2
    Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro
  • python3.7
    Fixed in 3.7.5-2ubuntu1~18.04.2+esm3
    Available with Ubuntu Pro: https://ubuntu.com/pro
  • python3.8
    Fixed in 3.8.0-3ubuntu1~18.04.2+esm2
    Available with Ubuntu Pro: https://ubuntu.com/pro

Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.

A release or ecosystem missing from this list has no record here. It may be unaffected or not covered by the source. Source notices and licences.