← Back

CVE-2022-37454

nvd nist
Published: Oct 21, 2022Modified: Jun 17, 2026

JSON object

Loading...
9.8
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitability: 3.9 / Impact: 5.9
Source: NVD

Description

The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to execute arbitrary code or eliminate expected cryptographic properties. This occurs in the sponge function interface.

Affected (15)

Show all products
Extended Keccak Code Package Project: Extended Keccak Code Package · Debian: Debian Linux · Fedoraproject: Fedora · Php: Php · Python: Python · Sha3 Project: Sha3 · Pysha3 Project: Pysha3 · Pypy: Pypy
Extended Keccak Code Package Project
1 product
Extended Keccak Code Package
Debian
1 product
Debian Linux
Fedoraproject
1 product
Fedora
Php
1 product
Php
Python
1 product
Python
Sha3 Project
1 product
Sha3
Pysha3 Project
1 product
Pysha3
Pypy
1 product
Pypy
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Extended Keccak Code Package
All versions
Configuration B
2 vulnerable
Vulnerable SoftwareAffected Versions
Debian
Debian Linux
Version 10.0
Debian Linux
Version 11.0
Configuration C
2 vulnerable
Vulnerable SoftwareAffected Versions
Fedoraproject
Fedora
Version 35
Fedora
Version 36
Configuration D
3 vulnerable
Vulnerable SoftwareAffected Versions
Php
Php
From 7.2.0 to 7.4.33
Php
From 8.0.0 to 8.0.25
Php
From 8.1.0 to 8.1.12
Configuration E
4 vulnerable
Vulnerable SoftwareAffected Versions
Python
Python
From 3.10.0 to 3.10.9
Python
From 3.6.0 to 3.7.16
Python
From 3.8.0 to 3.8.16
Python
From 3.9.0 to 3.9.16
Configuration F
1 vulnerable
Vulnerable SoftwareAffected Versions
Sha3
Before 1.0.5
Configuration G
1 vulnerable
Vulnerable SoftwareAffected Versions
Pysha3
All versions
Configuration H
1 vulnerable
Vulnerable SoftwareAffected Versions
Pypy
From 7.0.0

Related CWEs

CWE-190
Integer Overflow or Wraparound
The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.

References (27)

Source: cve@mitre.org
Third Party AdvisoryUS Government Resource
Source: cve@mitre.org
Source: cve@mitre.org
PatchThird Party Advisory
Source: cve@mitre.org
Mailing ListThird Party Advisory
Source: cve@mitre.org
Mailing ListThird Party Advisory
Source: cve@mitre.org
Mailing ListThird Party Advisory
Source: cve@mitre.org
Mailing ListThird Party Advisory
Source: cve@mitre.org
ExploitThird Party Advisory
Source: cve@mitre.org
Issue TrackingThird Party Advisory
Source: cve@mitre.org
Source: cve@mitre.org
Source: cve@mitre.org
Third Party Advisory
Source: cve@mitre.org
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party AdvisoryUS Government Resource
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing ListThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing ListThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing ListThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing ListThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
ExploitThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Issue TrackingThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory

Timeline

No history available yet.