Integer Overflow and Buffer Overflow in Keccak XKCP SHA-3 Reference Implementation
Summary
CVE-2022-37454: The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to execute arbitrary code or eliminate expected cryptographic properties. Affects python3 across 3 version ranges.
< 3.10.9-r0
>= 5c4568a05a0a62b5947c55f68f9f2ecfb90a4f12, < 3f82aa744678620a811927dc4e56ad9c7c3d0c14
>= 8148cbb78841c8ec0759c0836e7f35dec799d300, < dca8d5565b947270a29f232bc54efd9df3b92b94
Fixed in 3.10.9-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Keccak XKCP SHA-3 reference implementation is a cryptographic library that provides functionality for the SHA-3 hashing algorithm. It is commonly used in various applications for secure hashing and cryptographic operations. However, a vulnerability has been discovered in the library that allows attackers to execute arbitrary code or compromise the expected cryptographic properties. This vulnerability is due to an integer overflow and resultant buffer overflow in the sponge function interface.
Vulnerability Detail
The integer overflow and buffer overflow vulnerability in the Keccak XKCP SHA-3 reference implementation can be exploited by attackers to execute arbitrary code or compromise the expected cryptographic properties. The vulnerability occurs in the sponge function interface, which is a critical component of the library. By exploiting the vulnerability, an attacker can manipulate the input data in a way that leads to the overflow, allowing them to execute arbitrary code or tamper with the cryptographic properties of the system. This can have severe consequences, including unauthorized access, data manipulation, or even complete system compromise.
How To Fix
Minimum fixed version
3.10.9-r0
This is the first release that contains the fix.
sudo apk add --upgrade python3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the affected package to the fixed version to mitigate the risk of exploitation.
Conclusion
The integer overflow and buffer overflow vulnerability in the Keccak XKCP SHA-3 reference implementation poses a significant risk to systems using the affected package. It is crucial to update to the fixed version as soon as possible to mitigate the risk of exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for python3 →
FAQ
This vulnerability allows attackers to execute arbitrary code or compromise the expected cryptographic properties. It can lead to unauthorized access, data manipulation, or complete system compromise.
The vulnerability affects versions of the Keccak XKCP SHA-3 reference implementation before fdc6fef.
There are no known public exploits for this vulnerability at the moment.
Yes, a fix is available in version 3.10.9-r0 or later of the affected package.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
Related vulnerabilities
Recent vulnerabilities recorded for python3.
