CVE-2022-37454
CVE-2022-37454
This page contains facts from public vulnerability sources. Check the original advisory before updating.
The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to execute arbitrary code or eliminate expected cryptographic properties. This occurs in the sponge function interface.
CVSS 9.8 · Critical · EPSS 7.4% · Fix available
- Published
- Updated
Affected products and versions
n/a
- Versions
- n/a: Unknown
No fix published
pypy3 Debian:12
- Affected ranges
- ECOSYSTEM: < 7.3.9+dfsg-5
Update to 7.3.9+dfsg-5
pypy3 Debian:13
- Affected ranges
- ECOSYSTEM: < 7.3.9+dfsg-5
Update to 7.3.9+dfsg-5
pypy3 Debian:14
- Affected ranges
- ECOSYSTEM: < 7.3.9+dfsg-5
Update to 7.3.9+dfsg-5
pysha3 PyPI
- Versions
- 0.1
- 0.2
- 0.2.1
- 0.2.2
- 0.3
- 1.0.0
- 1.0.1
- 1.0.2
- 1.0.2.dev1
- 1.0b1
- Affected ranges
- ECOSYSTEM: ≤ 1.0.2
No fix published
sha3 RubyGems
- Versions
- 0.1.0
- 0.1.1
- 0.2.0
- 0.2.2
- 0.2.3
- 0.2.5
- 0.2.6
- 1.0.1
- 1.0.2
- 1.0.3
- 1.0.4
- Affected ranges
- ECOSYSTEM: < 1.0.5
Update to 1.0.5
pysha3 Ubuntu:16.04:LTS
- Versions
- 1.0.0-0ubuntu1~ubuntu16.04.1
- 1.0.0-0ubuntu1~ubuntu16.04.2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
php7.2 Ubuntu:18.04:LTS
- Versions
- 7.2.1-1ubuntu2
- 7.2.2-1ubuntu1
- 7.2.2-1ubuntu2
- 7.2.3-1ubuntu1
- 7.2.5-0ubuntu0.18.04.1
- 7.2.7-0ubuntu0.18.04.1
- 7.2.7-0ubuntu0.18.04.2
- 7.2.10-0ubuntu0.18.04.1
- 7.2.15-0ubuntu0.18.04.1
- 7.2.15-0ubuntu0.18.04.2
- 7.2.17-0ubuntu0.18.04.1
- 7.2.19-0ubuntu0.18.04.1
- 7.2.19-0ubuntu0.18.04.2
- 7.2.24-0ubuntu0.18.04.1
- 7.2.24-0ubuntu0.18.04.2
- 7.2.24-0ubuntu0.18.04.3
- 7.2.24-0ubuntu0.18.04.4
- 7.2.24-0ubuntu0.18.04.6
- 7.2.24-0ubuntu0.18.04.7
- 7.2.24-0ubuntu0.18.04.8
- 7.2.24-0ubuntu0.18.04.9
- 7.2.24-0ubuntu0.18.04.10
- 7.2.24-0ubuntu0.18.04.11
- 7.2.24-0ubuntu0.18.04.12
- 7.2.24-0ubuntu0.18.04.13
- Affected ranges
- ECOSYSTEM: < 7.2.24-0ubuntu0.18.04.15
Update to 7.2.24-0ubuntu0.18.04.15
python3.6 Ubuntu:18.04:LTS
- Versions
- 3.6.3-1ubuntu1
- 3.6.4~rc1-1
- 3.6.4~rc1-2
- 3.6.4-1
- 3.6.4-2
- 3.6.4-3build1
- 3.6.4-4
- 3.6.5~rc1-1
- 3.6.5-3
- 3.6.6-1~18.04
- 3.6.7-1~18.04
- 3.6.8-1~18.04.1
- 3.6.8-1~18.04.2
- 3.6.8-1~18.04.3
- 3.6.9-1~18.04
- 3.6.9-1~18.04ubuntu1
- 3.6.9-1~18.04ubuntu1.1
- 3.6.9-1~18.04ubuntu1.3
- 3.6.9-1~18.04ubuntu1.4
- 3.6.9-1~18.04ubuntu1.6
- 3.6.9-1~18.04ubuntu1.7
- 3.6.9-1~18.04ubuntu1.8
- 3.6.9-1~18.04ubuntu1.9
- Affected ranges
- ECOSYSTEM: < 3.6.9-1~18.04ubuntu1.10
Update to 3.6.9-1~18.04ubuntu1.10
pysha3 Ubuntu:18.04:LTS
- Versions
- 1.0.0-0ubuntu3
- 1.0.2-2ubuntu1
- 1.0.2-2ubuntu2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
python3.7 Ubuntu:Pro:18.04:LTS
- Versions
- 3.7.0~a2-1
- 3.7.0~a3-1
- 3.7.0~a3-2
- 3.7.0~a3-3
- 3.7.0~a4-1
- 3.7.0~b1-1
- 3.7.0~b1-1build1
- 3.7.0~b2-1
- 3.7.0~b3-1
- 3.7.0-1~18.04
- 3.7.1-1~18.04
- 3.7.3-2~18.04.1
- 3.7.5-2~18.04
- 3.7.5-2~18.04.4
- 3.7.5-2ubuntu1~18.04.2
- 3.7.5-2ubuntu1~18.04.2+esm1
- Affected ranges
- ECOSYSTEM: < 3.7.5-2ubuntu1~18.04.2+esm2
Update to 3.7.5-2ubuntu1~18.04.2+esm2
python3.8 Ubuntu:Pro:18.04:LTS
- Versions
- 3.8.0-3~18.04
- 3.8.0-3~18.04.1
- 3.8.0-3ubuntu1~18.04.2
- Affected ranges
- ECOSYSTEM: < 3.8.0-3ubuntu1~18.04.2+esm1
Update to 3.8.0-3ubuntu1~18.04.2+esm1
php7.4 Ubuntu:20.04:LTS
- Versions
- 7.4.3-4build1
- 7.4.3-4build2
- 7.4.3-4ubuntu1
- 7.4.3-4ubuntu1.1
- 7.4.3-4ubuntu2.2
- 7.4.3-4ubuntu2.4
- 7.4.3-4ubuntu2.5
- 7.4.3-4ubuntu2.6
- 7.4.3-4ubuntu2.7
- 7.4.3-4ubuntu2.8
- 7.4.3-4ubuntu2.9
- 7.4.3-4ubuntu2.10
- 7.4.3-4ubuntu2.11
- 7.4.3-4ubuntu2.12
- 7.4.3-4ubuntu2.13
- Affected ranges
- ECOSYSTEM: < 7.4.3-4ubuntu2.15
Update to 7.4.3-4ubuntu2.15
pypy3 Ubuntu:20.04:LTS
- Versions
- 7.1.1+dfsg-1
- 7.2.0+dfsg-1
- 7.3.0+dfsg-1
- 7.3.0+dfsg-1ubuntu2
- 7.3.0+dfsg-1ubuntu3
- 7.3.1+dfsg-4
- Affected ranges
- ECOSYSTEM: < 7.3.1+dfsg-4ubuntu0.1
Update to 7.3.1+dfsg-4ubuntu0.1
pysha3 Ubuntu:20.04:LTS
- Versions
- 1.0.2-2ubuntu4
- 1.0.2-2ubuntu5
- 1.0.2-4
- Affected ranges
- ECOSYSTEM: < 1.0.2-4ubuntu0.1
Update to 1.0.2-4ubuntu0.1
python3.8 Ubuntu:20.04:LTS
- Versions
- 3.8.0-1
- 3.8.0-2
- 3.8.0-3
- 3.8.0-4
- 3.8.0-5
- 3.8.1-2ubuntu3
- 3.8.2~rc1-1ubuntu1
- 3.8.2-1
- 3.8.2-1ubuntu1
- 3.8.2-1ubuntu1.1
- 3.8.2-1ubuntu1.2
- 3.8.5-1~20.04
- 3.8.5-1~20.04.2
- 3.8.5-1~20.04.3
- 3.8.10-0ubuntu1~20.04
- 3.8.10-0ubuntu1~20.04.1
- 3.8.10-0ubuntu1~20.04.2
- 3.8.10-0ubuntu1~20.04.4
- 3.8.10-0ubuntu1~20.04.5
- Affected ranges
- ECOSYSTEM: < 3.8.10-0ubuntu1~20.04.6
Update to 3.8.10-0ubuntu1~20.04.6
python3.9 Ubuntu:Pro:20.04:LTS
- Versions
- 3.9.0~rc1-1~20.04
- 3.9.0-5~20.04
- 3.9.5-3~20.04.1
- 3.9.5-3ubuntu0~20.04.1
- Affected ranges
- ECOSYSTEM: < 3.9.5-3ubuntu0~20.04.1+esm1
Update to 3.9.5-3ubuntu0~20.04.1+esm1
php8.1 Ubuntu:22.04:LTS
- Versions
- 8.1.0~rc4-1ubuntu2
- 8.1.0-1
- 8.1.2-1ubuntu1
- 8.1.2-1ubuntu2
- 8.1.2-1ubuntu2.1
- 8.1.2-1ubuntu2.2
- 8.1.2-1ubuntu2.3
- 8.1.2-1ubuntu2.4
- 8.1.2-1ubuntu2.5
- 8.1.2-1ubuntu2.6
- Affected ranges
- ECOSYSTEM: < 8.1.2-1ubuntu2.8
Update to 8.1.2-1ubuntu2.8
pypy3 Ubuntu:22.04:LTS
- Versions
- 7.3.5+dfsg-2
- 7.3.7+dfsg-1
- 7.3.7+dfsg-4
- 7.3.7+dfsg-5
- 7.3.8+dfsg-2
- 7.3.9+dfsg-1
- Affected ranges
- ECOSYSTEM: < 7.3.9+dfsg-1ubuntu0.1
Update to 7.3.9+dfsg-1ubuntu0.1
pysha3 Ubuntu:22.04:LTS
- Versions
- 1.0.2-4.1build2
- 1.0.2-4.1build3
- 1.0.2-4.2
- 1.0.2-4.2build1
- Affected ranges
- ECOSYSTEM: < 1.0.2-4.2ubuntu0.22.04.1
Update to 1.0.2-4.2ubuntu0.22.04.1
python3.10 Ubuntu:22.04:LTS
- Versions
- 3.10.0-2
- 3.10.0-3
- 3.10.0-4
- 3.10.0-5
- 3.10.0-5build1
- 3.10.1-1
- 3.10.1-2
- 3.10.2-1
- 3.10.2-5
- 3.10.2-7
- 3.10.3-1
- 3.10.4-3
- 3.10.4-3ubuntu0.1
- 3.10.6-1~22.04
- 3.10.6-1~22.04.1
- Affected ranges
- ECOSYSTEM: < 3.10.6-1~22.04.2
Update to 3.10.6-1~22.04.2
Original sources
- https://csrc.nist.gov/projects/hash-functions/sha-3-project
- https://mouha.be/sha-3-buffer-overflow/
- https://news.ycombinator.com/item?id=33281106
- https://github.com/XKCP/XKCP/security/advisories/GHSA-6w4m-2xhg-2658
- https://lists.debian.org/debian-lts-announce/2022/10/msg00041.html
- https://lists.debian.org/debian-lts-announce/2022/11/msg00000.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CMIEXLMTW5GO36HTFFWIPB3OHZXCT3G4/
- https://www.debian.org/security/2022/dsa-5267
- https://www.debian.org/security/2022/dsa-5269
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3ALQ6BDDPX5HU5YBQOBMDVAA2TSGDKIJ/
- https://eprint.iacr.org/2023/331
- https://news.ycombinator.com/item?id=35050307
- https://security.gentoo.org/glsa/202305-02
- https://security.netapp.com/advisory/ntap-20230203-0001/
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html
- https://cert-portal.siemens.com/productcert/html/ssa-806742.html
- https://cert-portal.siemens.com/productcert/html/ssa-455250.html
- https://nvd.nist.gov/vuln/detail/CVE-2022-37454