CVE-2022-37454 — פרטי פגיעות

תיאור (מקור, אנגלית)

The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to execute arbitrary code or eliminate expected cryptographic properties. This occurs in the sponge function interface.

מדדים

CVSS 3.1: 9.8 (CRITICAL) מקור הציון: NVD CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS — סבירות ניצול: 7% (אחוזון 100) נכון ל-19/10/2026
CWE: CWE-190

מוצרים מושפעים

extended_keccak_code_package_project: extended keccak code package; debian: debian linux; fedoraproject: fedora; php: php; python: python; sha3_project: sha3; pysha3_project: pysha3; pypy: pypy

קישורים

https://github.com/XKCP/XKCP/security/advisories/GHSA-6w4m-2xhg-2658 PatchThird Party Advisory
https://github.com/XKCP/XKCP/security/advisories/GHSA-6w4m-2xhg-2658 PatchThird Party Advisory
https://mouha.be/sha-3-buffer-overflow/ ExploitThird Party Advisory
https://mouha.be/sha-3-buffer-overflow/ ExploitThird Party Advisory
https://csrc.nist.gov/projects/hash-functions/sha-3-project Third Party AdvisoryUS Government Resource
https://eprint.iacr.org/2023/331
https://lists.debian.org/debian-lts-announce/2022/10/msg00041.html Mailing ListThird Party Advisory
https://lists.debian.org/debian-lts-announce/2022/11/msg00000.html Mailing ListThird Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorap‮… Mailing ListThird Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorap‮… Mailing ListThird Party Advisory

תיאור (מקור, אנגלית)

מדדים

מוצרים מושפעים

קישורים

נגישות