CVEvulnerability

CVE-2022-37454

9.8 CRITICAL Published 2022-10-21 Modified 2026-10-14 Official page ↗
Status
Modified
Published
2022-10-21
Last modified
2026-10-14
Assigner
[email protected]
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-190

Description

The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to execute arbitrary code or eliminate expected cryptographic properties. This occurs in the sponge function interface.

Affected configurations

• extended keccak code package project extended keccak code package • debian debian linux 10.0 • debian debian linux 11.0 • fedoraproject fedora 35 • fedoraproject fedora 36 • php php (>= 7.2.0 < 7.4.33) • php php (>= 8.0.0 < 8.0.25) • php php (>= 8.1.0 < 8.1.12) • python python (>= 3.6.0 < 3.7.16) • python python (>= 3.8.0 < 3.8.16) • python python (>= 3.9.0 < 3.9.16) • python python (>= 3.10.0 < 3.10.9) • sha3 project sha3 (< 1.0.5) • pysha3 project pysha3 • pypy pypy (>= 7.0.0)

Related

Weakness · CWE (1)

  • CWE-190 Integer Overflow or Wraparound weakness

References