CVE-2022-37454

CRITICAL

Extended Keccak Code Package < 7.4.33 - Integer Overflow

Title source: rule

Description

The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to execute arbitrary code or eliminate expected cryptographic properties. This occurs in the sponge function interface.

References (14)

Scores

CVSS v3 9.8
EPSS 0.0133
EPSS Percentile 79.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Classification

CWE
CWE-190
Status published

Affected Products (12)

extended_keccak_code_package_project/extended_keccak_code_package
debian/debian_linux
debian/debian_linux
fedoraproject/fedora
fedoraproject/fedora
php/php < 7.4.33
python/python < 3.7.16
sha3_project/sha3 < 1.0.5
pysha3_project/pysha3
pypy/pypy
pypi/pysha3 PyPI
rubygems/sha3 < 1.0.5RubyGems

Timeline

Published Oct 21, 2022
Tracked Since Feb 18, 2026