CVE-2022-37454

Name
CVE-2022-37454
Description
The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to execute arbitrary code or eliminate expected cryptographic properties. This occurs in the sponge function interface.
NVD Severity
unknown
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
MISC https://news.ycombinator.com/item?id=33281106
MISC https://csrc.nist.gov/projects/hash-functions/sha-3-project
MISC https://mouha.be/sha-3-buffer-overflow/
MISC https://github.com/XKCP/XKCP/security/advisories/GHSA-6w4m-2xhg-2658
MLIST https://lists.debian.org/debian-lts-announce/2022/10/msg00041.html
MLIST https://lists.debian.org/debian-lts-announce/2022/11/msg00000.html
DEBIAN https://www.debian.org/security/2022/dsa-5267
DEBIAN https://www.debian.org/security/2022/dsa-5269
MISC https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CMIEXLMTW5GO36HTFFWIPB3OHZXCT3G4/
MISC https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3ALQ6BDDPX5HU5YBQOBMDVAA2TSGDKIJ/
MISC https://eprint.iacr.org/2023/331
MISC https://news.ycombinator.com/item?id=35050307
MISC https://security.gentoo.org/glsa/202305-02
af854a3a-2127-422b-91ae-364da2661108 https://security.netapp.com/advisory/ntap-20230203-0001/

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:extended_keccak_code_package_project:extended_keccak_code_package:-:*:*:*:*:*:*:* extended_keccak_code_package == None == -

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
python3 3.17-main 3.10.9-r0 Natanael Copa <ncopa@alpinelinux.org> fixed
php82 edge-community 8.2.0_rc5-r0 None fixed
php82 3.22-community 8.2.0_rc5-r0 None fixed
php82 3.21-community 8.2.0_rc5-r0 None fixed
php82 3.20-community 8.2.0_rc5-r0 None fixed
php82 3.19-community 8.2.0_rc5-r0 None fixed
php82 3.18-community 8.2.0_rc5-r0 None fixed
php81 edge-community 8.1.12-r0 Andy Postnikov <apostnikov@gmail.com> fixed
php81 3.19-community 8.1.12-r0 None fixed
php81 3.18-community 8.1.12-r0 None fixed
php81 3.17-community 8.1.12-r0 None fixed
php8 edge-community 8.0.25-r0 Andy Postnikov <apostnikov@gmail.com> fixed