A critical vulnerability, CVE-2022-37454, has been discovered in the Keccak XKCP SHA-3 reference implementation, affecting various software configurations and systems running on 64-bit Windows, Linux, and macOS operating systems. This vulnerability is caused by an integer overflow and resultant buffer overflow, which can allow attackers to execute arbitrary code or eliminate expected cryptographic properties.

How do I know if I'm affected?

If you're using software like Python, PHP, Debian Linux, Fedora, Ruby, Pysha3, or Pypy, you might be affected by the vulnerability. The issue impacts specific versions and ranges of these software configurations. To know if you're affected, check the software versions you're using against the known affected configurations listed on the NVD page for this vulnerability. Keep in mind that this vulnerability affects 64-bit Windows, Linux, and macOS operating systems.

What should I do if I'm affected?

If you're affected by the vulnerability, it's important to take action to protect your systems. First, check for updates and patches for the affected software, such as Python, PHP, or your operating system. Install any available updates to fix the vulnerability. Additionally, stay informed about the latest developments in hash functions and cryptographic algorithms, and follow guidelines and standards provided by organizations like NIST for secure hash functions.

Is this in CISA’s Known Exploited Vulnerabilities Catalog?

The CVE-2022-37454 vulnerability is not listed in CISA's Known Exploited Vulnerabilities Catalog. This vulnerability, discovered in the Keccak XKCP SHA-3 reference implementation, can lead to a buffer overflow, allowing attackers to execute arbitrary code or eliminate expected cryptographic properties.

Weakness enumeration

The weakness enumeration for this vulnerability is categorized as CWE-190, which involves an integer overflow and buffer overflow in the Keccak XKCP SHA-3 reference implementation, affecting various software configurations and cryptographic properties.

For more details

CVE-2022-37454 is a critical vulnerability affecting various software configurations and systems. To gain a deeper understanding of its description, severity, technical details, and known affected software configurations, refer to the NVD page or the links below.

• Hash Functions | CSRC

• A Vulnerability in Implementations of SHA-3, SHAKE, EdDSA, and Other NIST-Approved Algorithms

• Fedora 36 Update: php-8.1.12-1.fc36

• SHA-3 Buffer Overflow – Nicky Mouha