9.8
CVSSv3

CVE-2022-37454

Published: 21/10/2022 Updated: 03/05/2023
CVSS v3 Base Score: 9.8 | Impact Score: 5.9 | Exploitability Score: 3.9
VMScore: 0

Vulnerability Summary

The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows malicious users to execute arbitrary code or eliminate expected cryptographic properties. This occurs in the sponge function interface.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

extended keccak code package project extended keccak code package -

debian debian linux 10.0

debian debian linux 11.0

fedoraproject fedora 35

fedoraproject fedora 36

php php

python python

sha3 project sha3

pysha3 project pysha3

pypy pypy

Vendor Advisories

Debian Bug report logs - #1023030 pysha3: Affected by CVE-2022-37454, unmaintained, remove from Debian? Package: src:pysha3; Maintainer for src:pysha3 is Ben Finney <bignose@debianorg>; Reported by: Stefano Rivera <stefanor@debianorg> Date: Sat, 29 Oct 2022 12:03:02 UTC Severity: grave Tags: security, upstream Fou ...
Synopsis Moderate: php:80 security update Type/Severity Security Advisory: Moderate Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for the php:80 module is now available for Red Hat Enterprise Linux 8Red Hat Product Security has rated this update as ...
Synopsis Moderate: php:81 security update Type/Severity Security Advisory: Moderate Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for the php:81 module is now available for Red Hat Enterprise Linux 9Red Hat Product Security has rated this update as ...
Several security issues were fixed in PHP ...
Several security issues were fixed in Python ...
Multiple security issues were discovered in PHP, a widely-used open source general purpose scripting language which could result in denial of service, information disclosure, insecure cooking handling or potentially the execution of arbitrary code For the stable distribution (bullseye), these problems have been fixed in version 7433-1+deb11u1 W ...
Nicky Mouha discovered a buffer overflow in sha3, a Python library for the SHA-3 hashing functions For the stable distribution (bullseye), this problem has been fixed in version 102-41+deb11u1 We recommend that you upgrade your pysha3 packages For the detailed security status of pysha3 please refer to its security tracker page at: sec ...
Nicky Mouha discovered a buffer overflow in the sha3 module of PyPy, a fast, compliant alternative implementation of the Python language For the stable distribution (bullseye), this problem has been fixed in version 735+dfsg-2+deb11u2 We recommend that you upgrade your pypy3 packages For the detailed security status of pypy3 please refer to it ...
The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to execute arbitrary code or eliminate expected cryptographic properties This occurs in the sponge function interface (CVE-2022-37454) ...
The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to execute arbitrary code or eliminate expected cryptographic properties This occurs in the sponge function interface (CVE-2022-37454) ...
DescriptionThe MITRE CVE dictionary describes this issue as: The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to execute arbitrary code or eliminate expected cryptographic properties This occurs in the sponge function interface ...
The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to execute arbitrary code or eliminate expected cryptographic properties This occurs in the sponge function interface (CVE-2022-37454) ...
The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to execute arbitrary code or eliminate expected cryptographic properties This occurs in the sponge function interface (CVE-2022-37454) ...
In PHP versions prior to 7433, 8025 and 8212, when using imageloadfont() function in gd extension, it is possible to supply a specially crafted font file, such as if the loaded font is used with imagechar() function, the read outside allocated buffer will be used This can lead to crashes or disclosure of confidential information (CVE-2022-3 ...
In PHP versions prior to 7433, 8025 and 8212, when using imageloadfont() function in gd extension, it is possible to supply a specially crafted font file, such as if the loaded font is used with imagechar() function, the read outside allocated buffer will be used This can lead to crashes or disclosure of confidential information (CVE-2022-3 ...
ALAS-2022-243 Amazon Linux 2022 Security Advisory: ALAS-2022-243 Advisory Release Date: 2022-12-06 16:44 Pacific ...
PAN-SA-2024-0001 Informational Bulletin: Impact of OSS CVEs in PAN-OS ...
PAN-SA-2024-0004 Informational Bulletin: OSS CVEs fixed in PAN-OS ...

Github Repositories

TEST-snyk-sha3-py-vuln Purpose A repo containing two simple script's to test Snyk's detection abilities of CVE-2022-37454, to be onboarded as a TestRepo to see if tooling is correctly identifying this vuln across Rapid7's other repo