CVE-2022-37454: Pysha3 Buffer Overflow Vulnerability

Q: What is CVE-2022-37454?

CVE-2022-37454 is a security vulnerability in Pysha3 involving Buffer overflow in sponge queue functions under CWE-190: Integer Overflow or Wraparound.

Q: Which Pysha3 versions are affected?

Affected versions include releases prior to 1.0.5 across affected packages: pysha3, sha3.

Q: What version fixes CVE-2022-37454?

Upgrading to 1.0.5 (or the latest patched release for your respective branch) resolves the vulnerability.

Q: Is pysha3 affected?

Yes, pysha3 is affected in releases prior to Latest secure release. Upgrade your dependency to Latest secure release or later.

Q: Is sha3 affected?

Yes, sha3 is affected in releases prior to 1.0.5. Upgrade your dependency to 1.0.5 or later.

Q: What is the CVSS score of CVE-2022-37454?

CVE-2022-37454 has a CVSS v3.1 base score of 9.8 (CRITICAL) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Q: What CWE is associated with CVE-2022-37454?

CVE-2022-37454 is classified under CWE-190: Integer Overflow or Wraparound (The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.).

Q: How can I check PyPI dependencies for CVE-2022-37454?

Run the dependency tree command: 'pip show pysha3'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.

CRITICAL

Advisory Identifier: GHSA-6w4m-2xhg-2658

CVSS 9.8

CWE-190

Published 2023-04-26

Advisory Summary

CVE-2022-37454 is a CRITICAL (CVSS 9.8) buffer overflow vulnerability (CWE-190: Integer Overflow or Wraparound) affecting Pysha3 libraries in the PyPI ecosystem. The issue involves buffer overflow in sponge queue functions. Remediation is available by upgrading affected packages to version 1.0.5.

CVE-2022-37454 at a Glance

CVE Identifier CVE-2022-37454

GHSA Identifier GHSA-6w4m-2xhg-2658

Severity CRITICAL

CVSS v3.1 Base Score 9.8

CWE Classification CWE-190: Integer Overflow or Wraparound

Affected Product Pysha3

Package Ecosystem PyPI

Published Date 2023-04-26

Last Updated 2023-04-26

Security Impact

CVSS: 9.8

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Attack Vector Network (AV:N)

Attack Complexity Low (AC:L)

Privileges Required None (PR:N)

User Interaction None (UI:N)

Scope Unchanged (S:U)

Confidentiality High (C:H)

Integrity High (I:H)

Availability High (A:H)

How to Fix CVE-2022-37454

To remediate this vulnerability, upgrade all affected Pysha3 dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

pysha3 fixed: Latest secure release

pip install pysha3>=Latest secure release

sha3 fixed: 1.0.5

Upgrade sha3 to 1.0.5

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release:

pip show pysha3

How to Check if You Are Affected

To determine whether your Python environment is affected by CVE-2022-37454, inspect your installed packages using pip:

pip show pysha3

Analyze the terminal output to locate any version of Pysha3 in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 1.0.5), your application is affected.

Note: The pip show pysha3 command checks currently installed packages in your active Python environment.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-190: Integer Overflow or Wraparound, where the product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. this occurs when an integer value is incremented to a value that is too large to store in the associated representation. when this occurs, the value may become a very small or negative number. In Pysha3, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

### Impact The Keccak sponge function interface accepts partial inputs to be absorbed and partial outputs to be squeezed. A buffer can overflow when partial data with some specific sizes are queued, where at least one of them has a length of 2^32 - 200 bytes or more. ### Patches Yes, see commit [fdc6fef0](https://github.com/XKCP/XKCP/commit/fdc6fef075f4e81d6b1bc38364248975e08e340a). ### Workarounds The problem can be avoided by limiting the size of the partial input data (or partial output digest) below 2^32 - 200 bytes. Multiple calls to the queue system can be chained at a higher level to retain the original functionality. Alternatively, one can process the entire input (or produce the entire output) at once, avoiding the queuing functions altogether. ### References See [issue #105](https://github.com/XKCP/XKCP/issues/105) for more details.

CVE-2022-37454 Affected Pysha3 Versions

2 component(s)

Fixed Versions:

1.0.5

Product / Package	Ecosystem	Affected Versions	Fixed Version
pysha3 pypi/pysha3	PyPI	≤ 1.0.2
sha3 gem/sha3	RubyGems	< 1.0.5	1.0.5

References

GitHub Advisory / Wiki ADVISORY

https://github.com/XKCP/XKCP/security/advisories/GHSA-6w4m-2xhg-2658

NVD — CVE-2022-37454 NVD

https://nvd.nist.gov/vuln/detail/CVE-2022-37454

Pysha3 Source Repository REPOSITORY

https://github.com/XKCP/XKCP/issues/105

Pysha3 Source Repository REPOSITORY

https://github.com/johanns/sha3/issues/17

Pysha3 Source Repository REPOSITORY

https://github.com/tiran/pysha3/issues/29

Security Fix Commit FIX COMMIT

https://github.com/XKCP/XKCP/commit/fdc6fef075f4e81d6b1bc38364248975e08e340a

Security Fix Commit FIX COMMIT

https://github.com/johanns/sha3/commit/5f2e8118a62831911703c8753ff2435c3b5d7312

Pysha3 Security Information SECURITY

https://www.debian.org/security/2022/dsa-5269

Pysha3 Security Information SECURITY

https://www.debian.org/security/2022/dsa-5267

Pysha3 Security Information SECURITY

https://security.gentoo.org/glsa/202305-02

news.ycombinator.com/item WEB

https://news.ycombinator.com/item?id=35050307

news.ycombinator.com/item WEB

https://news.ycombinator.com/item?id=33281106

mouha.be/sha-3-buffer-overfl... WEB

https://mouha.be/sha-3-buffer-overflow

lists.fedoraproject.org/archives/list/packa... WEB

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CMIEXLMTW5GO36HTFFWIPB3OHZXCT3G4

lists.fedoraproject.org/archives/list/packa... WEB

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3ALQ6BDDPX5HU5YBQOBMDVAA2TSGDKIJ

lists.fedoraproject.org/archives/list/packa... WEB

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CMIEXLMTW5GO36HTFFWIPB3OHZXCT3G4

lists.fedoraproject.org/archives/list/packa... WEB

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3ALQ6BDDPX5HU5YBQOBMDVAA2TSGDKIJ

lists.debian.org/debian-lts-announce... WEB

https://lists.debian.org/debian-lts-announce/2022/11/msg00000.html

lists.debian.org/debian-lts-announce... WEB

https://lists.debian.org/debian-lts-announce/2022/10/msg00041.html

Pysha3 Source Repository REPOSITORY

https://github.com/rubysec/ruby-advisory-db/blob/master/gems/sha3/CVE-2022-37454.yml

eprint.iacr.org/2023/331 WEB

https://eprint.iacr.org/2023/331

csrc.nist.gov/projects/hash-funct... WEB

https://csrc.nist.gov/projects/hash-functions/sha-3-project

Frequently Asked Questions

What is CVE-2022-37454?

CVE-2022-37454 is a security vulnerability in Pysha3 involving Buffer overflow in sponge queue functions under CWE-190: Integer Overflow or Wraparound.

Which Pysha3 versions are affected?

Affected versions include releases prior to 1.0.5 across affected packages: pysha3, sha3.

What version fixes CVE-2022-37454?

Upgrading to 1.0.5 (or the latest patched release for your respective branch) resolves the vulnerability.

Is pysha3 affected?

Yes, pysha3 is affected in releases prior to Latest secure release. Upgrade your dependency to Latest secure release or later.

Is sha3 affected?

Yes, sha3 is affected in releases prior to 1.0.5. Upgrade your dependency to 1.0.5 or later.

What is the CVSS score of CVE-2022-37454?

CVE-2022-37454 has a CVSS v3.1 base score of 9.8 (CRITICAL) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

What CWE is associated with CVE-2022-37454?

CVE-2022-37454 is classified under CWE-190: Integer Overflow or Wraparound (The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.).

How can I check PyPI dependencies for CVE-2022-37454?

Run the dependency tree command: 'pip show pysha3'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.

Machine-readable OSV JSON OSV v1.5 Schema

Normalized schema output

View Raw JSON

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-6w4m-2xhg-2658",
  "modified" : "2023-04-26T17:39:58Z",
  "published" : "2023-04-26T17:39:58Z",
  "aliases" : [ "CVE-2022-37454" ],
  "summary" : "Buffer overflow in sponge queue functions",
  "details" : "### Impact\n\nThe Keccak sponge function interface accepts partial inputs to be absorbed and partial outputs to be squeezed. A buffer can overflow when partial data with some specific sizes are queued, where at least one of them has a length of 2^32 - 200 bytes or more.\n\n### Patches\n\nYes, see commit [fdc6fef0](https://github.com/XKCP/XKCP/commit/fdc6fef075f4e81d6b1bc38364248975e08e340a).\n\n### Workarounds\n\nThe problem can be avoided by limiting the size of the partial input data (or partial output digest) below 2^32 - 200 bytes. Multiple calls to the queue system can be chained at a higher level to retain the original functionality. Alternatively, one can process the entire input (or produce the entire output) at once, avoiding the queuing functions altogether.\n\n### References\n\nSee [issue #105](https://github.com/XKCP/XKCP/issues/105) for more details.\n",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "PyPI",
      "name" : "pysha3"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "last_affected" : "1.0.2"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "RubyGems",
      "name" : "sha3"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "1.0.5"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/XKCP/XKCP/security/advisories/GHSA-6w4m-2xhg-2658"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2022-37454"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/XKCP/XKCP/issues/105"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/johanns/sha3/issues/17"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/tiran/pysha3/issues/29"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/XKCP/XKCP/commit/fdc6fef075f4e81d6b1bc38364248975e08e340a"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/johanns/sha3/commit/5f2e8118a62831911703c8753ff2435c3b5d7312"
  }, {
    "type" : "WEB",
    "url" : "https://www.debian.org/security/2022/dsa-5269"
  }, {
    "type" : "WEB",
    "url" : "https://www.debian.org/security/2022/dsa-5267"
  }, {
    "type" : "WEB",
    "url" : "https://security.gentoo.org/glsa/202305-02"
  }, {
    "type" : "WEB",
    "url" : "https://news.ycombinator.com/item?id=35050307"
  }, {
    "type" : "WEB",
    "url" : "https://news.ycombinator.com/item?id=33281106"
  }, {
    "type" : "WEB",
    "url" : "https://mouha.be/sha-3-buffer-overflow"
  }, {
    "type" : "WEB",
    "url" : "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CMIEXLMTW5GO36HTFFWIPB3OHZXCT3G4"
  }, {
    "type" : "WEB",
    "url" : "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3ALQ6BDDPX5HU5YBQOBMDVAA2TSGDKIJ"
  }, {
    "type" : "WEB",
    "url" : "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CMIEXLMTW5GO36HTFFWIPB3OHZXCT3G4"
  }, {
    "type" : "WEB",
    "url" : "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3ALQ6BDDPX5HU5YBQOBMDVAA2TSGDKIJ"
  }, {
    "type" : "WEB",
    "url" : "https://lists.debian.org/debian-lts-announce/2022/11/msg00000.html"
  }, {
    "type" : "WEB",
    "url" : "https://lists.debian.org/debian-lts-announce/2022/10/msg00041.html"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/sha3/CVE-2022-37454.yml"
  }, {
    "type" : "WEB",
    "url" : "https://eprint.iacr.org/2023/331"
  }, {
    "type" : "WEB",
    "url" : "https://csrc.nist.gov/projects/hash-functions/sha-3-project"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-190" ],
    "severity" : "CRITICAL",
    "github_reviewed" : true,
    "github_reviewed_at" : "2023-04-26T17:39:58Z",
    "nvd_published_at" : "2022-10-21T06:15:00Z"
  }
}

CVSS V3

9.8 CRITICAL

Attack Vector Network (AV:N)

Attack Complexity Low (AC:L)

Privileges Required None (PR:N)

User Interaction None (UI:N)

Scope Unchanged (S:U)

Confidentiality High (C:H)

Integrity High (I:H)

Availability High (A:H)

Vector String

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Advisory Metadata

Source ID: GHSA-6w4m-2xhg-2658
Schema Version: 1.4.0
Published: 2023-04-26 17:39
Last Modified: 2023-04-26 17:39
Database Record File: advisories/github-reviewed/2023/04/GHSA-6w4m-2xhg-2658/GHSA-6w4m-2xhg-2658.json