CVE search · CVE-2022-37454
CVE-2022-37454
critical 9.8
The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to execute arbitrary code or eliminate expected cryptographic properties. This occurs in the sponge function interface.
Details
- Status
- Modified
- Published
- Last changed
- Source
- cve@mitre.org
- Weakness
- CWE-190
Severity
| Version | Score | Vector | Source |
|---|---|---|---|
| CVSS 3.1 | critical 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
nvd@nist.govPrimary |
| CVSS 3.1 | critical 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
134c704f-9b21-4f2e-91b3-4a467353bcc0Secondary |
Affected products
Vendor and product from the NVD’s CPE applicability statements. Versions and conditions are on the NVD’s page.
- extended_keccak_code_package_project · extended_keccak_code_package
- debian · debian_linux
- fedoraproject · fedora
- php · php
- python · python
- sha3_project · sha3
- pysha3_project · pysha3
- pypy · pypy
References
- https://csrc.nist.gov/projects/hash-functions/sha-3-projectThird Party AdvisoryUS Government Resource
- https://eprint.iacr.org/2023/331
- https://github.com/XKCP/XKCP/security/advisories/GHSA-6w4m-2xhg-2658PatchThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2022/10/msg00041.htmlMailing ListThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2022/11/msg00000.htmlMailing ListThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3ALQ6BDDPX5HU5YBQOBMDVAA2TSGDKIJ/Mailing ListThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CMIEXLMTW5GO36HTFFWIPB3OHZXCT3G4/Mailing ListThird Party Advisory
- https://mouha.be/sha-3-buffer-overflow/ExploitThird Party Advisory
- https://news.ycombinator.com/item?id=33281106Issue TrackingThird Party Advisory
- https://news.ycombinator.com/item?id=35050307
- https://security.gentoo.org/glsa/202305-02
- https://www.debian.org/security/2022/dsa-5267Third Party Advisory
- https://www.debian.org/security/2022/dsa-5269Third Party Advisory
- https://csrc.nist.gov/projects/hash-functions/sha-3-projectThird Party AdvisoryUS Government Resource
- https://eprint.iacr.org/2023/331
- https://github.com/XKCP/XKCP/security/advisories/GHSA-6w4m-2xhg-2658PatchThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2022/10/msg00041.htmlMailing ListThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2022/11/msg00000.htmlMailing ListThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3ALQ6BDDPX5HU5YBQOBMDVAA2TSGDKIJ/Mailing ListThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CMIEXLMTW5GO36HTFFWIPB3OHZXCT3G4/Mailing ListThird Party Advisory
- https://mouha.be/sha-3-buffer-overflow/ExploitThird Party Advisory
- https://news.ycombinator.com/item?id=33281106Issue TrackingThird Party Advisory
- https://news.ycombinator.com/item?id=35050307
- https://security.gentoo.org/glsa/202305-02
- https://security.netapp.com/advisory/ntap-20230203-0001/
- https://www.debian.org/security/2022/dsa-5267Third Party Advisory
- https://www.debian.org/security/2022/dsa-5269Third Party Advisory
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html
- https://cert-portal.siemens.com/productcert/html/ssa-455250.html
- https://cert-portal.siemens.com/productcert/html/ssa-806742.html