CVE-2022-37454: Critical Buffer Overflow Vulnerability in libpython Package
Summary
CVE-2022-37454: The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to execute arbitrary code or eliminate expected cryptographic properties. Affects libpython across 4 version ranges.
>= 3.6.0, < 3.7.16
>= 3.8.0, < 3.8.16
>= 3.9.0, < 3.9.16
>= 3.10.0, < 3.10.9
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- pysha3 · PyPI
- libphp · Bitnami
- python-min · Bitnami
- php-min · Bitnami
- python · Bitnami
- php · Bitnami
- pysha3 · PyPI
- python3 · Alpine:v3.16
The same CVE-2022-37454 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libpython is a widely used library that provides Python programming language functionalities. It is integral to many applications that rely on Python for scripting and automation. The library is known for its versatility and ease of integration into various software projects. However, it has been found to have a critical vulnerability that can lead to severe security risks.
Vulnerability Detail
The vulnerability identified as CVE-2022-37454 arises from an integer overflow and resultant buffer overflow in the Keccak XKCP SHA-3 reference implementation prior to commit fdc6fef. This flaw allows attackers to execute arbitrary code or compromise the expected cryptographic properties of the library. The issue is particularly concerning as it can be exploited through the sponge function interface, leading to potential unauthorized access and manipulation of sensitive data.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 3.6.0, < 3.7.163.7.16 -
>= 3.8.0, < 3.8.163.8.16 -
>= 3.9.0, < 3.9.163.9.16 -
>= 3.10.0, < 3.10.93.10.9
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, consider restricting access to the affected functions or using an alternative library that does not exhibit this vulnerability until an update can be applied.
Conclusion
The CVE-2022-37454 vulnerability in the libpython package poses significant security risks due to its potential for arbitrary code execution. It is crucial for users to update to the patched versions to mitigate these risks. Utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for libpython →
FAQ
CVE-2022-37454 is a critical vulnerability in the libpython package that allows for buffer overflow and potential arbitrary code execution.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without any signup.
Exploitation of this vulnerability can lead to unauthorized code execution, data breaches, and compromise of cryptographic integrity.
Yes, patched versions of the libpython package are available. Users should update to versions 3.7.16, 3.8.16, 3.9.16, or 3.10.9.
If immediate updates are not possible, consider implementing access restrictions to the affected functions or using alternative libraries.
Related vulnerabilities
Recent vulnerabilities recorded for libpython.
