CVE-2022-37454: Keccak XKCP SHA-3 Reference Implementation Integer Overflow and Buffer Overflow in PHP
Summary
CVE-2022-37454: The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to execute arbitrary code or eliminate expected cryptographic properties. Affects php across 3 version ranges.
>= 7.2.0, < 7.4.33
>= 8.0.0, < 8.0.25
>= 8.1.0, < 8.1.12
Fixed in 7.4.33, 8.0.25 or 8.1.12, depending on the release line you run. How to fix ↓
Also tracked for
- pysha3 · PyPI
- libphp · Bitnami
- libpython · Bitnami
- python-min · Bitnami
- php-min · Bitnami
- python · Bitnami
- pysha3 · PyPI
- python3 · Alpine:v3.16
The same CVE-2022-37454 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PHP is a popular general-purpose scripting language widely used for web development. It provides a wide range of functionality and is known for its ease of use and flexibility. The Keccak XKCP SHA-3 reference implementation is a cryptographic library used in PHP for SHA-3 hashing. This vulnerability affects versions 7.2.0 and above of PHP, including versions 8.0.0 and 8.1.0. The vulnerability allows attackers to execute arbitrary code or eliminate expected cryptographic properties by exploiting an integer overflow and resultant buffer overflow in the sponge function interface.
Vulnerability Detail
The Keccak XKCP SHA-3 reference implementation in PHP suffers from an integer overflow and buffer overflow vulnerability. This vulnerability occurs in the sponge function interface and can be exploited by attackers to execute arbitrary code or tamper with cryptographic properties. The integer overflow leads to a buffer overflow, allowing an attacker to overwrite adjacent memory and potentially gain control of the affected system. The impact of this vulnerability is critical, as it can lead to unauthorized code execution and compromise the integrity and confidentiality of the system.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 7.2.0, < 7.4.337.4.33 -
>= 8.0.0, < 8.0.258.0.25 -
>= 8.1.0, < 8.1.128.1.12
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update PHP to a fixed version as soon as possible.
Conclusion
The Keccak XKCP SHA-3 reference implementation in PHP is vulnerable to an integer overflow and buffer overflow, allowing attackers to execute arbitrary code or tamper with cryptographic properties. It is crucial to update PHP to a fixed version (7.4.33, 8.0.25, or 8.1.12) to mitigate the risk of exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for php →
FAQ
This vulnerability allows attackers to execute arbitrary code or tamper with cryptographic properties, potentially leading to unauthorized access, data breaches, and system compromise.
Versions 7.2.0 and above of PHP, including versions 8.0.0 and 8.1.0, are affected by this vulnerability.
Yes, the vulnerability has been fixed in PHP versions 7.4.33, 8.0.25, and 8.1.12. It is recommended to update PHP to one of these fixed versions.
No, there is no known workaround for this vulnerability. Updating PHP to a fixed version is the recommended solution.
You can find more information about this vulnerability in the official vulnerability database of Bitnami, the organization that reported this issue. The link to the database is provided in the vulnerability details.
Related vulnerabilities
Recent vulnerabilities recorded for php.
