CVE-2022-37454: Integer Overflow
Fixed bug : buffer overflow in hashupdate() on long parameter. (CVE-2022-37454)
Other sources
The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to execute arbitrary code or eliminate expected cryptographic properties. This occurs in the sponge function interface.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2022-37454?
CVE-2022-37454 is a fixed bug in the Keccak XKCP SHA-3 reference implementation that allows attackers to execute arbitrary code or eliminate expected cryptographic properties.
How does CVE-2022-37454 impact PHP?
CVE-2022-37454 affects PHP versions up to 7.4.33 and can be exploited to execute arbitrary code.
How can I fix CVE-2022-37454 in PHP?
To fix CVE-2022-37454 in PHP, update to version 7.4.33 or later.
What is the affected software for CVE-2022-37454?
The affected software includes PHP versions up to 7.4.33, PHP 7.3.31-1~deb10u4, PHP 7.4.33-1+deb11u3 and 7.4.33-1+deb11u4, PyPy3 versions 7.0.0+dfsg-3, 7.3.5+dfsg-2+deb11u2, 7.3.11+dfsg-2, and 7.3.12+dfsg-1, pysha3 versions 1.0.2-2+deb10u1 and 1.0.2-4.1+deb11u1, Python 2.7.16-2+deb10u1, 2.7.16-2+deb10u2, and 2.7.18-8, Python 3.10.12-1, Python 3.7.3-2+deb10u5, and Python 3.9 versions up to 3.9.2-1.
Where can I find more information about CVE-2022-37454?
More information about CVE-2022-37454 can be found in the PHP changelog at https://www.php.net/ChangeLog-7.php#7.4.33 and the XKCP/XKCP GitHub repository at https://github.com/XKCP/XKCP/security/advisories/GHSA-6w4m-2xhg-2658. The specific fix is available in the commit fdc6fef075f4e81d6b1bc38364248975e08e340a.