Use-after-free in Python - CVE-2022-48560

Vulnerability identifier: #VU82078

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-48560

CWE-ID: CWE-416

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service attack.

The vulnerability exists due to use-after-free exists via heappushpop in heapq. A remote attacker can trigger the vulnerability to perform a denial of service attack.

Python
Isolation Segment
VMware Tanzu Application Service for VMs
Service Telemetry Framework
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
Red Hat Advanced Cluster Security for Kubernetes
IBM Watson Knowledge Catalog in Cloud Pak for Data
IBM Process Mining
App Connect Enterprise Certified Container
IBM Robotic Process Automation
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Server for SAP Applications 12
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Anolis OS
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux for x86_64 - Extended Update Support
SUSE Linux Enterprise Workstation Extension 12
Ubuntu
Fedora
Dell EMC PowerProtect Data Protection
SmartFabric OS10
Platform Automation Toolkit
Enterprise SONiC
IBM Cloud Pak for Watson AIOps
Robotic Process Automation for Cloud Pak
Juniper Secure Analytics (JSA)
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
python3.5 (Ubuntu package)
python3.5-minimal (Ubuntu package)
python3.7-minimal (Ubuntu package)
python3.7 (Ubuntu package)
python3.6-minimal (Ubuntu package)
python3.6 (Ubuntu package)
python3.9-minimal (Ubuntu package)
python3.9 (Ubuntu package)
python3.8-minimal (Ubuntu package)
python3.8 (Ubuntu package)
python3.11-minimal (Ubuntu package)
python3.11 (Ubuntu package)
python2.7 (Ubuntu package)
python2-pluggy
python2-PyMySQL
python2-docutils
python2-markupsafe
python2-Cython
python2-wheel-wheel
python2-wheel
python2-scipy
python2-funcsigs
python2-backports
python2-ipaddress
python-sqlalchemy-doc
python2-sqlalchemy
python-nose-docs
python2-nose
python2-py
python2-pysocks
python2-pytest-mock
python2-six
python2-numpy-doc
python2-numpy
python2-numpy-f2py
python2-dns
python2-setuptools_scm
python2-urllib3
python2-mock
python2-pygments
python2-babel
babel
python2-idna
python-psycopg2-doc
python2-psycopg2
python2-psycopg2-tests
python2-psycopg2-debug
python2-docs-info
python2-docs
python2-test
python2-tkinter
python2-tools
python2-libs
python2-devel
python2
python2-debug
libpython2_7-1_0-debuginfo-32bit
python-base-debugsource
python-base-debuginfo
python-devel
python-xml-debuginfo
python-xml
python
python-debugsource
libpython2_7-1_0
python-debuginfo
python-base
python-curses-debuginfo
python-curses
python-gdbm
python-idle
python-tk
python-tk-debuginfo
python-32bit
python-debuginfo-32bit
libpython2_7-1_0-32bit
python-base-debuginfo-32bit
python-base-32bit
python-doc-pdf
python-doc
python-demo
python-gdbm-debuginfo
libpython2_7-1_0-debuginfo
python2.7
python2-jinja2
python2-requests
python2-chardet
python2-pytest
python2-backports-ssl_match_hostname
python3 (Red Hat package)
python3-test
python3-tkinter
python3-libs
python3-idle
python3-devel
platform-python-devel
platform-python-debug
platform-python
python2-pymongo
python2-pymongo-gridfs
python2-bson
python3.10-minimal (Ubuntu package)
python3.10 (Ubuntu package)
python3.12-minimal (Ubuntu package)
python3.12 (Ubuntu package)
python2-pyyaml
python2-rpm-macros
python2-lxml
python2-coverage
python2-pip
python2-pip-wheel
python2-virtualenv
python2-attrs
python2-setuptools-wheel
python2-setuptools
python2-pytz
Red Hat OpenShift GitOps
VMware Tanzu Operations Manager
IBM Qradar SIEM

Install updates from vendor's website.

Isolation Segment - addressed in versions 2.11.42, 2.13.27, 3.0.20, 4.0.12
VMware Tanzu Application Service for VMs - addressed in versions 2.11.48, 2.13.30, 3.0.20, 4.0.12
Service Telemetry Framework - update to 1.5.4
Dell EMC PowerProtect Data Protection - update to 2.7.8
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 4.8.0
Red Hat Advanced Cluster Security for Kubernetes - update to 4.1.6
IBM Watson Knowledge Catalog in Cloud Pak for Data - addressed in versions 4.8.8, 4.8.9, 5.1.1, 5.1.2, 5.1.3
Juniper Secure Analytics (JSA) - update to 7.5.0 UP8 IF03
SmartFabric OS10 - addressed in versions 10.5.4.11, 10.5.6.1
python3.5 (Ubuntu package) - update to Ubuntu Pro (Infra-only)
python3.5-minimal (Ubuntu package) - update to Ubuntu Pro
python3.7-minimal (Ubuntu package) - update to Ubuntu Pro
python3.7 (Ubuntu package) - update to Ubuntu Pro
python3.6-minimal (Ubuntu package) - update to Ubuntu Pro
python3.6 (Ubuntu package) - update to Ubuntu Pro
python3.9-minimal (Ubuntu package) - update to Ubuntu Pro
python3.9 (Ubuntu package) - update to Ubuntu Pro
python3.8-minimal (Ubuntu package) - addressed in versions Ubuntu Pro, 3.8.10-0ubuntu1~20.04.10
python3.8 (Ubuntu package) - addressed in versions Ubuntu Pro, 3.8.10-0ubuntu1~20.04.10
python3.11-minimal (Ubuntu package) - addressed in versions Ubuntu Pro, 3.11.6-3ubuntu0.1
python3.11 (Ubuntu package) - addressed in versions Ubuntu Pro, 3.11.6-3ubuntu0.1
python2.7 (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 2.7.18-1~20.04.7, 2.7.18-13ubuntu1.5
python2-pluggy - update to 0.6.0-8
python2-PyMySQL - update to 0.8.0-10
python2-docutils - update to 0.14-12
python2-markupsafe - update to 0.23-19
python2-Cython - update to 0.28.1-7
python2-wheel-wheel - update to 0.31.1-3
python2-wheel - update to 0.31.1-3
python2-scipy - update to 1.0.0-22
python2-funcsigs - update to 1.0.2-13
python2-backports - update to 1.0-16
python2-ipaddress - update to 1.0.18-6
python-sqlalchemy-doc - update to 1.3.2-2
python2-sqlalchemy - update to 1.3.2-2
python-nose-docs - update to 1.3.7-31
python2-nose - update to 1.3.7-31
python2-py - update to 1.5.3-6
python2-pysocks - update to 1.6.8-6
python2-pytest-mock - update to 1.9.0-4
Red Hat OpenShift GitOps - addressed in versions 1.10.0, 1.11
python2-six - update to 1.11.0-6
IBM Process Mining - update to 1.14.2
python2-numpy-doc - update to 1.14.2-16.0.1
python2-numpy - update to 1.14.2-16.0.1
python2-numpy-f2py - update to 1.14.2-16.0.1
python2-dns - update to 1.15.0-10
python2-setuptools_scm - update to 1.15.7-6
python2-urllib3 - update to 1.24.2-4
python2-mock - update to 2.0.0-13
python2-pygments - update to 2.2.0-22
python2-babel - update to 2.5.1-10
babel - update to 2.5.1-10
python2-idna - update to 2.5-7
python-psycopg2-doc - update to 2.7.5-8
python2-psycopg2 - update to 2.7.5-8
python2-psycopg2-tests - update to 2.7.5-8
python2-psycopg2-debug - update to 2.7.5-8
python2-docs-info - update to 2.7.16-2
python2-docs - update to 2.7.16-2
python2-test - update to 2.7.18-17.0.1
python2-tkinter - update to 2.7.18-17.0.1
python2-tools - update to 2.7.18-17.0.1
python2-libs - update to 2.7.18-17.0.1
python2-devel - update to 2.7.18-17.0.1
python2 - update to 2.7.18-17.0.1
python2-debug - update to 2.7.18-17.0.1
libpython2_7-1_0-debuginfo-32bit - update to 2.7.18-33.32.1
python-base-debugsource - update to 2.7.18-33.32.1
python-base-debuginfo - update to 2.7.18-33.32.1
python-devel - update to 2.7.18-33.32.1
python-xml-debuginfo - update to 2.7.18-33.32.1
python-xml - update to 2.7.18-33.32.1
python - update to 2.7.18-33.32.1
python-debugsource - update to 2.7.18-33.32.1
libpython2_7-1_0 - update to 2.7.18-33.32.1
python-debuginfo - update to 2.7.18-33.32.1
python-base - update to 2.7.18-33.32.1
python-curses-debuginfo - update to 2.7.18-33.32.1
python-curses - update to 2.7.18-33.32.1
python-gdbm - update to 2.7.18-33.32.1
python-idle - update to 2.7.18-33.32.1
python-tk - update to 2.7.18-33.32.1
python-tk-debuginfo - update to 2.7.18-33.32.1
python-32bit - update to 2.7.18-33.32.1
python-debuginfo-32bit - update to 2.7.18-33.32.1
libpython2_7-1_0-32bit - update to 2.7.18-33.32.1
python-base-debuginfo-32bit - update to 2.7.18-33.32.1
python-base-32bit - update to 2.7.18-33.32.1
python-doc-pdf - update to 2.7.18-33.32.1
python-doc - update to 2.7.18-33.32.1
python-demo - update to 2.7.18-33.32.1
python-gdbm-debuginfo - update to 2.7.18-33.32.1
libpython2_7-1_0-debuginfo - update to 2.7.18-33.32.1
python2.7 - addressed in versions 2.7.18-36.fc37, 2.7.18-36.fc38, 2.7.18-36.fc39, 2.7.18-36.fc40
python2-jinja2 - update to 2.10-10
VMware Tanzu Operations Manager - addressed in versions 2.10.50, 2.10.62
python2-requests - update to 2.20.0-4
python2-chardet - update to 3.0.4-10
python2-pytest - update to 3.4.2-13
python2-backports-ssl_match_hostname - update to 3.5.0.1-12
python3 (Red Hat package) - addressed in versions 3.6.8-47.el8_6.4, 3.6.8-51.el8_8.4
python3-test - update to 3.6.8-56.0.1
python3-tkinter - update to 3.6.8-56.0.1
python3-libs - update to 3.6.8-56.0.1
python3-idle - update to 3.6.8-56.0.1
python3-devel - update to 3.6.8-56.0.1
platform-python-devel - update to 3.6.8-56.0.1
platform-python-debug - update to 3.6.8-56.0.1
platform-python - update to 3.6.8-56.0.1
python2-pymongo - update to 3.7.0-1.0.1
python2-pymongo-gridfs - update to 3.7.0-1.0.1
python2-bson - update to 3.7.0-1.0.1
python3.10-minimal (Ubuntu package) - update to 3.10.12-1~22.04.4
python3.10 (Ubuntu package) - update to 3.10.12-1~22.04.4
python3.12-minimal (Ubuntu package) - update to 3.12.0-1ubuntu0.1
python3.12 (Ubuntu package) - update to 3.12.0-1ubuntu0.1
python2-pyyaml - update to 3.12-16
python2-rpm-macros - update to 3-38
Platform Automation Toolkit - addressed in versions 4.0.13, 4.1.13, 4.2.8, 4.3.5
Enterprise SONiC - update to 4.1.2
python2-lxml - update to 4.2.3-6
IBM Cloud Pak for Watson AIOps - update to 4.5.0
python2-coverage - update to 4.5.1-5
App Connect Enterprise Certified Container - addressed in versions 5.0.14, 11.2.0
IBM Qradar SIEM - update to 7.5.0 Update Pack 8 IF01
python2-pip - update to 9.0.3-19.0.1
python2-pip-wheel - update to 9.0.3-19.0.1
python2-virtualenv - update to 15.1.0-22
python2-attrs - update to 17.4.0-10
IBM Robotic Process Automation - addressed in versions 21.0.7.18, 23.0.18
Robotic Process Automation for Cloud Pak - addressed in versions 21.0.7.18, 23.0.18
python2-setuptools-wheel - update to 39.0.1-14
python2-setuptools - update to 39.0.1-14
python2-pytz - update to 2017.2-13

• https://bugs.python.org/issue39421
• https://lists.debian.org/debian-lts-announce/2023/09/msg00022.html
• https://security.netapp.com/advisory/ntap-20230929-0008/
• https://lists.debian.org/debian-lts-announce/2023/10/msg00017.html

• Use-after-free in IBM Process Mining
• Ubuntu update for python3.5
• Ubuntu update for python2.7
• VMware Tanzu products update for Python
• Fedora 39 update for python2.7
• Fedora 38 update for python2.7
• Fedora 37 update for python2.7
• Fedora 40 update for python2.7
• Multiple vulnerabilities in Dell EMC Enterprise SONiC
• Multiple vulnerabilities in IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
• VMware Tanzu products update for Python
• Multiple vulnerabilities in Red Hat Advanced Cluster Security for Kubernetes 4.1
• Red Hat Enterprise Linux 8.6 Extended Update Support update for python3
• Red Hat Enterprise Linux 8.8 Extended Update Support update for python3
• Multiple vulnerabilities in IBM App Connect Enterprise Certified Container
• Multiple vulnerabilities in Service Telemetry Framework 1.5
• Multiple vulnerabilities in Red Hat OpenShift GitOps
• Multiple vulnerabilities in Red Hat OpenShift GitOps
• Multiple vulnerabilities in IBM Cloud Pak for AIOps
• Multiple vulnerabilities in IBM QRadar SIEM
• Multiple vulnerabilities in Dell Networking OS10
• SUSE update for python
• Red Hat Enterprise Linux 8 update for the python27:2.7 module
• Multiple vulnerabilities in Juniper Secure Analytics (JSA)
• Ubuntu update for python3.10
• Multiple vulnerabilities in Dell SmartFabric OS10
• Multiple vulnerabilities in IBM Robotic Process Automation
• Ubuntu update for python2.7
• Anolis OS update for python3
• Anolis OS update for python27:2.7 module
• PowerProtect Data Protection software update for third-party components
• Multiple vulnerabilities in IBM Watson Knowledge Catalog