CVE-2022-37454: Integer Overflow

Published Oct 21, 2022
·
Updated

Fixed bug : buffer overflow in hashupdate() on long parameter. (CVE-2022-37454)

Other sources

The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to execute arbitrary code or eliminate expected cryptographic properties. This occurs in the sponge function interface.

— Launchpad

Affected Software

36 affected componentsFixes available
debian/pysha3<=1.0.2-2, <=1.0.2-4.1, <=1.0.2-4.2
1.0.2-4.1+deb11u11.0.2-5
PHP PHP<8.0.25
8.0.25
Extended Keccak Code Package Project Extended Keccak Code Package
Debian Debian Linux=10.0
Debian Debian Linux=11.0
Fedoraproject Fedora=35
Fedoraproject Fedora=36
PHP PHP>=7.2.0<7.4.33
PHP PHP>=8.0.0<8.0.25
PHP PHP>=8.1.0<8.1.12
Python Python>=3.6.0<3.7.16
Python Python>=3.8.0<3.8.16
Python Python>=3.9.0<3.9.16
Python Python>=3.10.0<3.10.9
Sha3 Project Sha3 Ruby<1.0.5
Pysha3 Project Pysha3
Pypy Pypy>=7.0.0
debian/pypy3<7.3.9+dfsg-5
7.3.9+dfsg-5
debian/pypy3<7.3.9+dfsg-5
7.3.9+dfsg-5
debian/pypy3<7.3.9+dfsg-5
7.3.9+dfsg-5
debian/pypy3
7.3.11+dfsg-2+deb12u37.3.19+dfsg-28.0.1+dfsg-1
alpine/php7<7.4.33-r0
7.4.33-r0
alpine/php7<7.4.33-r0
7.4.33-r0
alpine/php8<8.0.25-r0
8.0.25-r0
alpine/php8<8.0.25-r0
8.0.25-r0
alpine/php81<8.1.12-r0
8.1.12-r0
alpine/php81<8.1.12-r0
8.1.12-r0
alpine/php81<8.1.12-r0
8.1.12-r0
alpine/php81<8.1.12-r0
8.1.12-r0
alpine/php82<8.2.0_rc5-r0
8.2.0_rc5-r0
alpine/php82<8.2.0_rc5-r0
8.2.0_rc5-r0
alpine/php82<8.2.0_rc5-r0
8.2.0_rc5-r0
alpine/php82<8.2.0_rc5-r0
8.2.0_rc5-r0
alpine/php82<8.2.0_rc5-r0
8.2.0_rc5-r0
alpine/python3<3.10.9-r0
3.10.9-r0
alpine/python3<3.10.9-r0
3.10.9-r0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade debian/pysha3 to a version that resolves this vulnerability.

    Fixed in 1.0.2-4.1+deb11u1Fixed in 1.0.2-5
  2. Upgrade

    Upgrade PHP to a version that resolves this vulnerability.

    Fixed in 8.0.25
  3. Upgrade

    Upgrade debian/pypy3 to a version that resolves this vulnerability.

    Fixed in 7.3.11+dfsg-2+deb12u3Fixed in 7.3.19+dfsg-2Fixed in 8.0.1+dfsg-1
  4. Upgrade

    Upgrade alpine/php7 to a version that resolves this vulnerability.

    Fixed in 7.4.33-r0
  5. Upgrade

    Upgrade alpine/php8 to a version that resolves this vulnerability.

    Fixed in 8.0.25-r0
  6. Upgrade

    Upgrade alpine/php81 to a version that resolves this vulnerability.

    Fixed in 8.1.12-r0
  7. Upgrade

    Upgrade alpine/php82 to a version that resolves this vulnerability.

    Fixed in 8.2.0_rc5-r0
  8. Upgrade

    Upgrade alpine/python3 to a version that resolves this vulnerability.

    Fixed in 3.10.9-r0
  9. Upgrade

    Upgrade debian/pypy3 to a version that resolves this vulnerability.

    Fixed in 7.3.9+dfsg-5
  10. Upgrade

    Upgrade Keccak XKCP SHA-3 reference implementation to a version that resolves this vulnerability.

    Patch fdc6fef

Event History

Oct 21, 2022
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via OSV·12:00 AM
DescriptionSeverity
Data Sourced
via NVD·06:15 AM
RemedyDescriptionSeverityWeaknessAffected Software
Data Sourced
via OSV·06:15 AM
Affected Software
Nov 4, 2022
Data Sourced
via Red Hat·07:16 PM
DescriptionSeverityAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Peer vulnerabilities

Found alongside the following vulnerabilities.

Frequently Asked Questions

1

What is CVE-2022-37454?

CVE-2022-37454 is a fixed bug in the Keccak XKCP SHA-3 reference implementation that allows attackers to execute arbitrary code or eliminate expected cryptographic properties.

2

How does CVE-2022-37454 impact PHP?

CVE-2022-37454 affects PHP versions up to 7.4.33 and can be exploited to execute arbitrary code.

3

How can I fix CVE-2022-37454 in PHP?

To fix CVE-2022-37454 in PHP, update to version 7.4.33 or later.

4

What is the affected software for CVE-2022-37454?

The affected software includes PHP versions up to 7.4.33, PHP 7.3.31-1~deb10u4, PHP 7.4.33-1+deb11u3 and 7.4.33-1+deb11u4, PyPy3 versions 7.0.0+dfsg-3, 7.3.5+dfsg-2+deb11u2, 7.3.11+dfsg-2, and 7.3.12+dfsg-1, pysha3 versions 1.0.2-2+deb10u1 and 1.0.2-4.1+deb11u1, Python 2.7.16-2+deb10u1, 2.7.16-2+deb10u2, and 2.7.18-8, Python 3.10.12-1, Python 3.7.3-2+deb10u5, and Python 3.9 versions up to 3.9.2-1.

5

Where can I find more information about CVE-2022-37454?

More information about CVE-2022-37454 can be found in the PHP changelog at https://www.php.net/ChangeLog-7.php#7.4.33 and the XKCP/XKCP GitHub repository at https://github.com/XKCP/XKCP/security/advisories/GHSA-6w4m-2xhg-2658. The specific fix is available in the commit fdc6fef075f4e81d6b1bc38364248975e08e340a.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203