CVE-2022-37454: Critical Buffer Overflow in Python-min Package Due to Integer Overflow
Summary
CVE-2022-37454: The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to execute arbitrary code or eliminate expected cryptographic properties. Affects python-min across 4 version ranges.
>= 3.6.0, < 3.7.16
>= 3.8.0, < 3.8.16
>= 3.9.0, < 3.9.16
>= 3.10.0, < 3.10.9
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- pysha3 · PyPI
- libphp · Bitnami
- libpython · Bitnami
- php-min · Bitnami
- python · Bitnami
- php · Bitnami
- pysha3 · PyPI
- python3 · Alpine:v3.16
The same CVE-2022-37454 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Python-min package, part of the Bitnami ecosystem, is a lightweight version of the Python programming language designed for minimal installations. It retains core functionalities of Python while reducing overhead, making it suitable for environments with limited resources. However, it is susceptible to vulnerabilities that can compromise its integrity and security, such as the one described in this report.
Vulnerability Detail
The vulnerability identified as CVE-2022-37454 arises from an integer overflow in the Keccak XKCP SHA-3 reference implementation, specifically in the sponge function interface. This flaw can lead to a buffer overflow, allowing attackers to execute arbitrary code or disrupt expected cryptographic properties. The issue affects multiple versions of the Python-min package, making it critical for users to address it promptly to maintain security.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 3.6.0, < 3.7.163.7.16 -
>= 3.8.0, < 3.8.163.8.16 -
>= 3.9.0, < 3.9.163.9.16 -
>= 3.10.0, < 3.10.93.10.9
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can avoid using the affected sponge function interface until they can update to a patched version. However, this is not a permanent solution and should only be considered until the update can be applied.
Conclusion
CVE-2022-37454 represents a significant security risk for users of the Python-min package due to its potential for arbitrary code execution. It is crucial for users to update to the patched versions to mitigate this vulnerability and ensure the security of their applications.
See every vulnerability recorded for python-min →
FAQ
CVE-2022-37454 is a critical vulnerability in the Python-min package that results from an integer overflow leading to a buffer overflow, potentially allowing arbitrary code execution.
The vulnerability affects Python-min versions prior to 3.7.16, 3.8.16, 3.9.16, and 3.10.9.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
If immediate updating is not possible, refrain from using the affected sponge function interface as a temporary workaround until you can apply the necessary updates.
More information can be found on the official CVE database or by visiting the GitHub repository for the Bitnami vulnerability database.
Related vulnerabilities
Recent vulnerabilities recorded for python-min.
