CVE-2022-37454

Published Oct 21, 2022

Last updated 7 days ago

Overview

Description
The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to execute arbitrary code or eliminate expected cryptographic properties. This occurs in the sponge function interface.
Source
cve@mitre.org
NVD status
Modified
Products
extended_keccak_code_package, debian_linux, fedora, php, python, sha3, pysha3, pypy

Risk scores

CVSS 3.1

Type
Primary
Base score
9.8
Impact score
5.9
Exploitability score
3.9
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity
CRITICAL

Weaknesses

nvd@nist.gov
CWE-190
134c704f-9b21-4f2e-91b3-4a467353bcc0
CWE-190

Social media

Hype score
Not currently trending

Configurations

References

Sources include official advisories and independent security research.