CVE-2022-37454
- Source
- https://cve.org/CVERecord?id=CVE-2022-37454
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-37454.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2022-37454
- Aliases
- Downstream
- Related
- Published
- 2022-10-21T06:15:09.333Z
- Modified
- 2026-03-15T22:47:04.742419Z
- Severity
-
- 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- [none]
- Details
-
The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to execute arbitrary code or eliminate expected cryptographic properties. This occurs in the sponge function interface.
- References
-
- https://news.ycombinator.com/item?id=35050307
- https://eprint.iacr.org/2023/331
- https://security.gentoo.org/glsa/202305-02
- https://www.debian.org/security/2022/dsa-5267
- https://lists.debian.org/debian-lts-announce/2022/11/msg00000.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CMIEXLMTW5GO36HTFFWIPB3OHZXCT3G4/
- https://www.debian.org/security/2022/dsa-5269
- https://security.netapp.com/advisory/ntap-20230203-0001/
- https://csrc.nist.gov/projects/hash-functions/sha-3-project
- https://lists.debian.org/debian-lts-announce/2022/10/msg00041.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3ALQ6BDDPX5HU5YBQOBMDVAA2TSGDKIJ/
- https://news.ycombinator.com/item?id=33281106
- https://github.com/XKCP/XKCP/security/advisories/GHSA-6w4m-2xhg-2658
- https://mouha.be/sha-3-buffer-overflow/
Affected packages
Git / github.com/php/php-src
Affected ranges
- Type
- GIT
- Repo
- https://github.com/php/php-src
- Events
- Database specific
{ "versions": [ { "introduced": "7.2.0" }, { "fixed": "7.4.33" }, { "introduced": "8.0.0" }, { "fixed": "8.0.25" }, { "introduced": "8.1.0" }, { "fixed": "8.1.12" } ] }
- Type
- GIT
- Repo
- https://github.com/python/cpython
- Events
-
IntroducedFixedIntroducedFixedIntroducedFixedIntroducedFixed
- Database specific
{ "versions": [ { "introduced": "3.6.0" }, { "fixed": "3.7.16" }, { "introduced": "3.8.0" }, { "fixed": "3.8.16" }, { "introduced": "3.9.0" }, { "fixed": "3.9.16" }, { "introduced": "3.10.0" }, { "fixed": "3.10.9" } ] }
Affected versions
v3.*
v3.10.0
v3.10.0a1
v3.10.0a2
v3.10.0a3
v3.10.0a4
v3.10.0a5
v3.10.0a6
v3.10.0a7
v3.10.0b1
v3.10.0b2
v3.10.0b3
v3.10.0b4
v3.10.0rc1
v3.10.0rc2
v3.10.1
v3.10.2
v3.10.3
v3.10.4
v3.10.5
v3.10.6
v3.10.7
v3.10.8
v3.4.6
v3.4.6rc1
v3.5.3
v3.5.3rc1
v3.6.0
v3.7.0a1
v3.7.0a2
v3.7.0a3
v3.7.0a4
v3.8.0a1
v3.8.0a2
v3.8.0a3
v3.8.0a4
v3.8.0b1
v3.9.0a1
v3.9.0a2
v3.9.0a3
v3.9.0a4
v3.9.0a5
v3.9.0a6
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-37454.json"
unresolved_ranges
[
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "10.0"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "11.0"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "35"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "36"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.0.5"
}
]
},
{
"events": [
{
"introduced": "7.0.0"
}
]
}
]