CRITICAL✓ PATCH🇵🇱 Wersja polska

CVE-2022-37454

CVSS 9.8v3.1pub. 2022-10-21upd. 2025-05-08

The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to execute arbitrary code or eliminate expected cryptographic properties. This occurs in the sponge function interface.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Debian

    OS
    Debian
    10.011.0

  • Extended Keccak Code Package Project Extended Keccak Code Package

    APP
    Extended Keccak Code Package Project
    all versions

  • Fedora Project Fedora

    OS
    Fedoraproject
    3536

  • PHP

    APP
    Php
    8.1.0 – 8.1.12 (excl.)7.2.0 – 7.4.33 (excl.)8.0.0 – 8.0.25 (excl.)

  • Pypy

    APP
    Pypy
    ≥ 7.0.0

  • Pysha3 Project Pysha3

    APP
    Pysha3 Project
    all versions

  • Python

    APP
    Python
    3.9.0 – 3.9.16 (excl.)3.6.0 – 3.7.16 (excl.)3.10.0 – 3.10.9 (excl.)3.8.0 – 3.8.16 (excl.)

  • Sha3 Project Sha3

    APP
    Sha3 Project
    < 1.0.5
🟢
PATCH AVAILABLE
Vendor update available. Deploy in standard maintenance cycle.
Tags
RCEMemory
CWE
References

Related vulnerabilities

CVE-2026-24061CRITICAL9.8⚠ KEVPL ✓same product

GNU Inetutils telnetd: ominięcie uwierzytelnienia przez zmienną USER

CVE-2025-32463CRITICAL9.3⚠ KEVPL ✓same product

Sudo: eskalacja uprawnień do root poprzez opcję --chroot (CVE-2025-32463)

CVE-2025-49113CRITICAL9.9⚠ KEVPL ✓same product

RCE przez deserializację PHP w Roundcube Webmail (parametr _from)

CVE-2025-32433CRITICAL10.0⚠ KEVPL ✓same product

Erlang/OTP SSH — nieuwierzytelniony RCE (CVSS 10.0)

CVE-2025-24201CRITICAL10.0⚠ KEVPL ✓same product

Apple WebKit: out-of-bounds write umożliwiający ucieczkę z sandbox przeglądarki