GHSA-6w4m-2xhg-2658 Buffer overflow in sponge queue functions

• PyPI pysha3: <= 1.0.2 (no fix yet) • RubyGems sha3: < 1.0.5 → fixed in 1.0.5

Impact The Keccak sponge function interface accepts partial inputs to be absorbed and partial outputs to be squeezed. A buffer can overflow when partial data with some specific sizes are queued, where at least one of them has a length of 2^32 - 200 bytes or more. Patches Yes, see commit fdc6fef0. Workarounds The problem can be avoided by limiting the size of the partial input data (or partial output digest) below 2^32 - 200 bytes. Multiple calls to the queue system can be chained at a higher level to retain the original functionality. Alternatively, one can process the entire input (or produce the entire output) at once, avoiding the queuing functions altogether. References See issue #105 for more details.