CVE-2022-37454
Publication date 21 October 2022
Last updated 24 July 2024
Ubuntu priority
The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to execute arbitrary code or eliminate expected cryptographic properties. This occurs in the sponge function interface.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| php5 | ||
| 22.04 LTS jammy | Not in release | |
| 20.04 LTS focal | Not in release | |
| 18.04 LTS bionic | Not in release | |
| 16.04 LTS xenial | Not in release | |
| 14.04 LTS trusty |
Not affected
|
|
| php7.0 | ||
| 22.04 LTS jammy | Not in release | |
| 20.04 LTS focal | Not in release | |
| 18.04 LTS bionic | Not in release | |
| 16.04 LTS xenial |
Not affected
|
|
| 14.04 LTS trusty | Not in release | |
| php7.2 | ||
| 22.04 LTS jammy | Not in release | |
| 20.04 LTS focal | Not in release | |
| 18.04 LTS bionic |
Fixed 7.2.24-0ubuntu0.18.04.15
|
|
| 16.04 LTS xenial | Not in release | |
| 14.04 LTS trusty | Not in release | |
| php7.4 | ||
| 22.04 LTS jammy | Not in release | |
| 20.04 LTS focal |
Fixed 7.4.3-4ubuntu2.15
|
|
| 18.04 LTS bionic | Not in release | |
| 16.04 LTS xenial | Not in release | |
| 14.04 LTS trusty | Not in release | |
| php8.1 | 24.04 LTS noble | Not in release |
| 22.04 LTS jammy |
Fixed 8.1.2-1ubuntu2.8
|
|
| 20.04 LTS focal | Not in release | |
| 18.04 LTS bionic | Not in release | |
| 16.04 LTS xenial | Not in release | |
| 14.04 LTS trusty | Not in release | |
| pypy3 | 24.04 LTS noble |
Not affected
|
| 22.04 LTS jammy |
Fixed 7.3.9+dfsg-1ubuntu0.1
|
|
| 20.04 LTS focal |
Fixed 7.3.1+dfsg-4ubuntu0.1
|
|
| 18.04 LTS bionic | Not in release | |
| 16.04 LTS xenial | Ignored | |
| 14.04 LTS trusty | Ignored | |
| pysha3 | 24.04 LTS noble | Not in release |
| 22.04 LTS jammy |
Fixed 1.0.2-4.2ubuntu0.22.04.1
|
|
| 20.04 LTS focal |
Fixed 1.0.2-4ubuntu0.1
|
|
| 18.04 LTS bionic |
Needs evaluation
|
|
| 16.04 LTS xenial |
Needs evaluation
|
|
| 14.04 LTS trusty | Ignored | |
| python3.10 | 24.04 LTS noble | Not in release |
| 22.04 LTS jammy |
Fixed 3.10.6-1~22.04.2
|
|
| 20.04 LTS focal | Not in release | |
| 18.04 LTS bionic | Not in release | |
| 16.04 LTS xenial | Not in release | |
| 14.04 LTS trusty | Not in release | |
| python3.11 | 24.04 LTS noble | Not in release |
| 22.04 LTS jammy |
Not affected
|
|
| 20.04 LTS focal | Not in release | |
| 18.04 LTS bionic | Not in release | |
| 16.04 LTS xenial | Not in release | |
| 14.04 LTS trusty | Not in release | |
| python3.6 | ||
| 22.04 LTS jammy | Not in release | |
| 20.04 LTS focal | Not in release | |
| 18.04 LTS bionic |
Fixed 3.6.9-1~18.04ubuntu1.10
|
|
| 16.04 LTS xenial | Not in release | |
| 14.04 LTS trusty | Not in release | |
| python3.7 | ||
| 22.04 LTS jammy | Not in release | |
| 20.04 LTS focal | Not in release | |
| 18.04 LTS bionic |
Fixed 3.7.5-2ubuntu1~18.04.2+esm2
|
|
| 16.04 LTS xenial | Not in release | |
| 14.04 LTS trusty | Not in release | |
| python3.8 | ||
| 22.04 LTS jammy | Not in release | |
| 20.04 LTS focal |
Fixed 3.8.10-0ubuntu1~20.04.6
|
|
| 18.04 LTS bionic |
Fixed 3.8.0-3ubuntu1~18.04.2+esm1
|
|
| 16.04 LTS xenial | Not in release | |
| 14.04 LTS trusty | Not in release | |
| python3.9 | ||
| 22.04 LTS jammy | Not in release | |
| 20.04 LTS focal |
Fixed 3.9.5-3ubuntu0~20.04.1+esm1
|
|
| 18.04 LTS bionic | Not in release | |
| 16.04 LTS xenial | Not in release | |
| 14.04 LTS trusty | Not in release |
Get expanded security coverage with Ubuntu Pro
Reduce your average CVE exposure time from 98 days to 1 day with expanded CVE patching, ten-years security maintenance and optional support for the full stack of open-source applications. Free for personal use.
Get Ubuntu ProNotes
sbeattie
PEAR issues should go against php-pear as of xenial
rodrigo-zaiden
PHP includes Keccak code for sha3 starting from php7.2
leosilva
in PHP it was introduced in 91663a92d1697fc30a7ba4687d73e0f63ec2baa1 php-7.2.0alpha1
mdeslaur
Python 3.11 switched to using tiny_sha3, so not affected.
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score |
9.8 · Critical
|
| Attack vector | Network |
| Attack complexity | Low |
| Privileges required | None |
| User interaction | None |
| Scope | Unchanged |
| Confidentiality | High |
| Integrity impact | High |
| Availability impact | High |
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
References
Related Ubuntu Security Notices (USN)
- USN-5717-1
- PHP vulnerabilities
- 8 November 2022
- USN-5767-1
- Python vulnerabilities
- 8 December 2022
- USN-5888-1
- Python vulnerabilities
- 27 February 2023
- USN-5767-3
- Python vulnerability
- 6 March 2023
- USN-5930-1
- Python vulnerability
- 7 March 2023
- USN-5931-1
- Python vulnerability
- 7 March 2023
- USN-6524-1
- PyPy vulnerability
- 29 November 2023
- USN-6525-1
- pysha3 vulnerability
- 29 November 2023
Other references
- https://github.com/XKCP/XKCP/security/advisories/GHSA-6w4m-2xhg-2658
- https://github.com/XKCP/XKCP/commit/fdc6fef075f4e81d6b1bc38364248975e08e340a
- https://mouha.be/sha-3-buffer-overflow/
- https://github.com/python/cpython/issues/98517
- https://github.com/python/cpython/commit/0e4e058602d93b88256ff90bbef501ba20be9dd3 (3.10-branch)
- https://github.com/python/cpython/commit/857efee6d2d43c5c12fc7e377ce437144c728ab8 (3.9-branch)
- https://github.com/python/cpython/commit/948c6794711458fd148a3fa62296cadeeb2ed631 (3.8-branch)
- https://github.com/python/cpython/commit/8088c90044ba04cd5624b278340ebf934dbee4a5 (3.7-branch)
- https://news.ycombinator.com/item?id=33281106
- https://csrc.nist.gov/projects/hash-functions/sha-3-project
- https://github.com/php/php-src/commit/248f647724e385bfb8d83aa5b5a5ca3c4ee2c7fd
- https://www.cve.org/CVERecord?id=CVE-2022-37454