CVE-2022-37454: Keccak XKCP SHA-3 Reference Implementation Integer Overflow and Buffer Overflow in Python
Summary
CVE-2022-37454: The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to execute arbitrary code or eliminate expected cryptographic properties. Affects python across 4 version ranges.
>= 3.6.0, < 3.7.16
>= 3.8.0, < 3.8.16
>= 3.9.0, < 3.9.16
>= 3.10.0, < 3.10.9
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- pysha3 · PyPI
- libphp · Bitnami
- libpython · Bitnami
- python-min · Bitnami
- php-min · Bitnami
- php · Bitnami
- pysha3 · PyPI
- python3 · Alpine:v3.16
The same CVE-2022-37454 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python is a popular programming language known for its simplicity and versatility. It is widely used for various applications, including web development, data analysis, and artificial intelligence. The Keccak XKCP SHA-3 reference implementation is a cryptographic library used in Python for secure hashing. It provides functions for generating hash values using the SHA-3 algorithm. However, a vulnerability has been discovered in this implementation that can lead to an integer overflow and subsequent buffer overflow, compromising the expected cryptographic properties of the library.
Vulnerability Detail
The vulnerability in the Keccak XKCP SHA-3 reference implementation arises from an integer overflow in the sponge function interface. An attacker can exploit this vulnerability to execute arbitrary code or manipulate the cryptographic properties of the library. This can have severe consequences, such as unauthorized access, data tampering, or the compromise of sensitive information. The vulnerability affects Python versions 3.6.0 and above.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 3.6.0, < 3.7.163.7.16 -
>= 3.8.0, < 3.8.163.8.16 -
>= 3.9.0, < 3.9.163.9.16 -
>= 3.10.0, < 3.10.93.10.9
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update the Python package to a fixed version as soon as possible.
Conclusion
The Keccak XKCP SHA-3 reference implementation in Python is vulnerable to an integer overflow and buffer overflow, which can have severe consequences. It is crucial to update the Python package to a fixed version to mitigate the risk of exploitation. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for python →
FAQ
The vulnerability allows attackers to execute arbitrary code or manipulate the cryptographic properties of the Keccak XKCP SHA-3 reference implementation in Python, potentially leading to unauthorized access, data tampering, or the compromise of sensitive information.
The vulnerability affects Python versions 3.6.0 and above.
No, there is no known workaround for this vulnerability. It is crucial to update the Python package to a fixed version.
To fix this vulnerability, update your Python installation to one of the fixed versions: 3.7.16, 3.8.16, 3.9.16, or 3.10.9.
For more information about this vulnerability, you can refer to the CVE-2022-37454 identifier or the provided source link.
Related vulnerabilities
Recent vulnerabilities recorded for python.
