CVE-2022-37454: pysha3 Buffer Overflow Vulnerability in Sponge Queue Functions
Summary
CVE-2022-37454: Buffer overflow in sponge queue functions. Affects pysha3 versions < 1.0.2. No fix is published. How to fix ↓
Also tracked for
- libphp · Bitnami
- libpython · Bitnami
- python-min · Bitnami
- php-min · Bitnami
- python · Bitnami
- php · Bitnami
- python3 · Alpine:v3.16
The same CVE-2022-37454 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
pysha3 is a Python library that provides implementations of the SHA-3 family of cryptographic hash functions, including Keccak. It is widely used for secure hashing in various applications. However, the library has a vulnerability that can lead to a buffer overflow when handling specific input sizes, potentially compromising the integrity and security of applications that rely on it.
Vulnerability Detail
The vulnerability arises from the Keccak sponge function interface, which allows for the absorption of partial inputs and the squeezing of partial outputs. When partial data with certain sizes is queued, particularly when one of the inputs is 2^32 - 200 bytes or larger, it can lead to a buffer overflow. This overflow can result in unexpected behavior, data corruption, or even arbitrary code execution, posing significant risks to applications utilizing this library.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, limit the size of the partial input data or output digest to below 2^32 - 200 bytes. You can also process the entire input or output at once, avoiding the queuing functions altogether. Here is an example of how to limit input size:
if len(partial_input) < (2**32 - 200):
sponge.queue(partial_input)
else:
# Handle input differently or raise an error
Conclusion
CVE-2022-37454 is a critical buffer overflow vulnerability in the pysha3 library that can lead to severe security risks. It is essential to update the library to the patched version or implement workarounds to mitigate the risks associated with this vulnerability.
See every vulnerability recorded for pysha3 →
FAQ
CVE-2022-37454 is a vulnerability in the pysha3 library that can lead to a buffer overflow when specific input sizes are processed.
If your application uses the pysha3 library and processes large inputs, it may be at risk of data corruption or arbitrary code execution due to this vulnerability.
You can implement a workaround by limiting the size of the input data or processing the entire input at once to avoid using the vulnerable queuing functions.
You can refer to the GitHub issue #105 for detailed discussions and updates regarding CVE-2022-37454.
Vulert monitors and alerts you in real-time for open-source vulnerabilities in your software using just the Pipfile.lock. You can check if your application is affected by this vulnerability using the Vulert playground without any signup.
References
Related vulnerabilities
Recent vulnerabilities recorded for pysha3.
