CVE-2022-37454 :: Enginsight Vulnerability Database

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	9.8 CRITICAL	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA-ADP	ADP	9.8 CRITICAL	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 79%

Affected Products (NVD)

Vendor	Product	Version
extended_keccak_code_package_project	extended_keccak_code_package	-
debian	debian_linux	10.0
debian	debian_linux	11.0
php	php	7.2.0 ≤ 𝑥 < 7.4.33
php	php	8.0.0 ≤ 𝑥 < 8.0.25
php	php	8.1.0 ≤ 𝑥 < 8.1.12
python	python	3.6.0 ≤ 𝑥 < 3.7.16
python	python	3.8.0 ≤ 𝑥 < 3.8.16
python	python	3.9.0 ≤ 𝑥 < 3.9.16
python	python	3.10.0 ≤ 𝑥 < 3.10.9
sha3_project	sha3	𝑥 < 1.0.5
pysha3_project	pysha3	*
pypy	pypy	7.0.0 ≤

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

php7.4

bullseye	7.4.33-1+deb11u5 fixed
bullseye (security)	7.4.33-1+deb11u6 fixed
buster	not-affected

pypy3

bookworm	7.3.11+dfsg-2+deb12u2 fixed
bullseye	7.3.5+dfsg-2+deb11u2 fixed
bullseye (security)	7.3.5+dfsg-2+deb11u2 fixed
buster	not-affected
sid	7.3.17+dfsg-2 fixed
trixie	7.3.17+dfsg-2 fixed

pysha3

bullseye	1.0.2-4.1+deb11u1 fixed
bullseye (security)	1.0.2-4.1+deb11u1 fixed
buster	not-affected

python2.7

bullseye	2.7.18-8+deb11u1 fixed
buster	not-affected

python3.9

bullseye	unimportant
buster	not-affected

Ubuntu Releases

Ubuntu Product

Codename

php5

bionic	dne
focal	dne
jammy	dne
kinetic	dne
trusty	not-affected
xenial	dne

php7.0

bionic	dne
focal	dne
jammy	dne
kinetic	dne
trusty	dne
xenial	not-affected

php7.2

bionic	Fixed 7.2.24-0ubuntu0.18.04.15 released
focal	dne
jammy	dne
kinetic	dne
trusty	dne
xenial	dne

php7.4

bionic	dne
focal	Fixed 7.4.3-4ubuntu2.15 released
jammy	dne
kinetic	dne
trusty	dne
xenial	dne

php8.1

bionic	dne
focal	dne
jammy	Fixed 8.1.2-1ubuntu2.8 released
kinetic	Fixed 8.1.7-1ubuntu3.1 released
lunar	Fixed 8.1.12-1ubuntu2 released
mantic	dne
noble	dne
trusty	dne
xenial	dne

pypy3

bionic	dne
focal	Fixed 7.3.1+dfsg-4ubuntu0.1 released
jammy	Fixed 7.3.9+dfsg-1ubuntu0.1 released
kinetic	ignored
lunar	not-affected
mantic	not-affected
noble	not-affected
trusty	ignored
xenial	ignored

pysha3

bionic	needs-triage
focal	Fixed 1.0.2-4ubuntu0.1 released
jammy	Fixed 1.0.2-4.2ubuntu0.22.04.1 released
kinetic	ignored
lunar	dne
mantic	dne
noble	dne
trusty	ignored
xenial	needs-triage

python3.10

bionic	dne
focal	dne
jammy	Fixed 3.10.6-1~22.04.2 released
kinetic	Fixed 3.10.7-1ubuntu0.2 released
lunar	dne
mantic	dne
noble	dne
trusty	dne
xenial	dne

python3.11

bionic	dne
focal	dne
jammy	not-affected
kinetic	not-affected
lunar	not-affected
mantic	not-affected
noble	dne
trusty	dne
xenial	dne

python3.6

bionic	Fixed 3.6.9-1~18.04ubuntu1.10 released
focal	dne
jammy	dne
kinetic	dne
trusty	dne
xenial	dne

python3.7

bionic	Fixed 3.7.5-2ubuntu1~18.04.2+esm2 released
focal	dne
jammy	dne
kinetic	dne
trusty	dne
xenial	dne

python3.8

bionic	Fixed 3.8.0-3ubuntu1~18.04.2+esm1 released
focal	Fixed 3.8.10-0ubuntu1~20.04.6 released
jammy	dne
kinetic	dne
trusty	dne
xenial	dne

python3.9

bionic	dne
focal	Fixed 3.9.5-3ubuntu0~20.04.1+esm1 released
jammy	dne
kinetic	dne
trusty	dne
xenial	dne

Known Exploits!

Common Weakness Enumeration

CWE-190 - Integer Overflow or Wraparound
The software performs a calculation that can produce an integer overflow or wraparound, when the logic assumes that the resulting value will always be larger than the original value. This can introduce other weaknesses when the calculation is used for resource management or execution control.

References

https://csrc.nist.gov/projects/hash-functions/sha-3-project

https://eprint.iacr.org/2023/331

https://github.com/XKCP/XKCP/security/advisories/GHSA-6w4m-2xhg-2658

https://lists.debian.org/debian-lts-announce/2022/10/msg00041.html

https://lists.debian.org/debian-lts-announce/2022/11/msg00000.html

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3ALQ6BDDPX5HU5YBQOBMDVAA2TSGDKIJ/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CMIEXLMTW5GO36HTFFWIPB3OHZXCT3G4/

https://mouha.be/sha-3-buffer-overflow/

https://news.ycombinator.com/item?id=33281106

https://news.ycombinator.com/item?id=35050307

https://security.gentoo.org/glsa/202305-02

https://www.debian.org/security/2022/dsa-5267

https://www.debian.org/security/2022/dsa-5269

https://csrc.nist.gov/projects/hash-functions/sha-3-project

https://eprint.iacr.org/2023/331

https://github.com/XKCP/XKCP/security/advisories/GHSA-6w4m-2xhg-2658

https://lists.debian.org/debian-lts-announce/2022/10/msg00041.html

https://lists.debian.org/debian-lts-announce/2022/11/msg00000.html

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3ALQ6BDDPX5HU5YBQOBMDVAA2TSGDKIJ/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CMIEXLMTW5GO36HTFFWIPB3OHZXCT3G4/

https://mouha.be/sha-3-buffer-overflow/

https://news.ycombinator.com/item?id=33281106

https://news.ycombinator.com/item?id=35050307

https://security.gentoo.org/glsa/202305-02

https://security.netapp.com/advisory/ntap-20230203-0001/

https://www.debian.org/security/2022/dsa-5267

https://www.debian.org/security/2022/dsa-5269