CVE-2022-37454

The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to execute arbitrary code or eliminate expected cryptographic properties. This occurs in the sponge function interface.

The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to execute arbitrary code or eliminate expected cryptographic properties. This occurs in the sponge function interface.

Impact

The Keccak sponge function interface accepts partial inputs to be absorbed and partial outputs to be squeezed. A buffer can overflow when partial data with some specific sizes are queued, where at least one of them has a length of 2^32 - 200 bytes or more.

Patches

Yes, see commit fdc6fef0.

Workarounds

The problem can be avoided by limiting the size of the partial input data (or partial output digest) below 2^32 - 200 bytes. Multiple calls to the queue system can be chained at a higher level to retain the original functionality. Alternatively, one can process the entire input (or produce the entire output) at once, avoiding the queuing functions altogether.

References

See issue #105 for more details.

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fairly simple. The most common use of PHP coding is probably as a replacement for CGI scripts.The php package contains the module (often referred to as mod_php) which adds support for the PHP language to Apache HTTP Server.

Security Fix(es):

The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to execute arbitrary code or eliminate expected cryptographic properties. This occurs in the sponge function interface.(CVE-2022-37454)

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing adatabase-enabled webpage with PHP is fairly simple. The most common use of PHP coding is probably as a replacement for CGI scripts.The php package contains the module (often referred to as mod_php)which adds support for the PHP language to Apache HTTP Server.

Security Fix(es):

The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to execute arbitrary code or eliminate expected cryptographic properties. This occurs in the sponge function interface.(CVE-2022-37454)

Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C++ (or other languages, depending on the chosen implementation). Python is also usable as an extension language for applications written in other languages that need easy-to-use scripting or automation interfaces. This package Provides python version 3.

Security Fix(es):

The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to execute arbitrary code or eliminate expected cryptographic properties. This occurs in the sponge function interface.(CVE-2022-37454)

Impact

The Keccak sponge function interface accepts partial inputs to be absorbed and partial outputs to be squeezed. A buffer can overflow when partial data with some specific sizes are queued, where at least one of them has a length of 2^32 - 200 bytes or more.

Patches

Yes, see commit fdc6fef0.

Workarounds

The problem can be avoided by limiting the size of the partial input data (or partial output digest) below 2^32 - 200 bytes. Multiple calls to the queue system can be chained at a higher level to retain the original functionality. Alternatively, one can process the entire input (or produce the entire output) at once, avoiding the queuing functions altogether.

References

See issue #105 for more details.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

The following packages have been upgraded to a later upstream version: php (8.0). (BZ#2161666)

Security Fix(es):

• XKCP: buffer overflow in the SHA-3 reference implementation (CVE-2022-37454)

• php: standard insecure cookie could be treated as a __Host- or __Secure- cookie by PHP applications (CVE-2022-31629)

• php: OOB read due to insufficient input validation in imageloadfont() (CVE-2022-31630)

• php: Due to an integer overflow PDO::quote() may return unquoted string (CVE-2022-31631)

• php: phar wrapper can occur dos when using quine gzip file (CVE-2022-31628)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

The following packages have been upgraded to a later upstream version: php (8.0.27). (BZ#2161667)

Security Fix(es):

• XKCP: buffer overflow in the SHA-3 reference implementation (CVE-2022-37454)

• php: standard insecure cookie could be treated as a __Host- or __Secure- cookie by PHP applications (CVE-2022-31629)

• php: OOB read due to insufficient input validation in imageloadfont() (CVE-2022-31630)

• php: Due to an integer overflow PDO::quote() may return unquoted string (CVE-2022-31631)

• php: phar wrapper can occur dos when using quine gzip file (CVE-2022-31628)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

The following packages have been upgraded to a later upstream version: php (8.1.14).

Security Fix(es):

• XKCP: buffer overflow in the SHA-3 reference implementation (CVE-2022-37454)

• php: standard insecure cookie could be treated as a '__Host-' or '__Secure-' cookie by PHP applications (CVE-2022-31629)

• php: OOB read due to insufficient input validation in imageloadfont() (CVE-2022-31630)

• php: PDO::quote() may return unquoted string due to an integer overflow (CVE-2022-31631)

• php: phar: infinite loop when decompressing quine gzip file (CVE-2022-31628)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 9.2 Release Notes linked from the References section.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

The following packages have been upgraded to a later upstream version: php (7.4.33).

Security Fix(es):

• XKCP: buffer overflow in the SHA-3 reference implementation (CVE-2022-37454)

• php: standard insecure cookie could be treated as a '__Host-' or '__Secure-' cookie by PHP applications (CVE-2022-31629)

• php: OOB read due to insufficient input validation in imageloadfont() (CVE-2022-31630)

• php: PDO::quote() may return unquoted string due to an integer overflow (CVE-2022-31631)

• php: phar: infinite loop when decompressing quine gzip file (CVE-2022-31628)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.8 Release Notes linked from the References section.

The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to execute arbitrary code or eliminate expected cryptographic properties. This occurs in the sponge function interface.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

The following packages have been upgraded to a later upstream version: php (8.0). (BZ#2161666)

Security Fix(es):

• XKCP: buffer overflow in the SHA-3 reference implementation (CVE-2022-37454)
• php: standard insecure cookie could be treated as a __Host- or __Secure- cookie by PHP applications (CVE-2022-31629)
• php: OOB read due to insufficient input validation in imageloadfont() (CVE-2022-31630)
• php: Due to an integer overflow PDO::quote() may return unquoted string (CVE-2022-31631)
• php: phar wrapper can occur dos when using quine gzip file (CVE-2022-31628)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

The following packages have been upgraded to a later upstream version: php (8.0.27). (BZ#2161667)

Security Fix(es):

• XKCP: buffer overflow in the SHA-3 reference implementation (CVE-2022-37454)
• php: standard insecure cookie could be treated as a __Host- or __Secure- cookie by PHP applications (CVE-2022-31629)
• php: OOB read due to insufficient input validation in imageloadfont() (CVE-2022-31630)
• php: Due to an integer overflow PDO::quote() may return unquoted string (CVE-2022-31631)
• php: phar wrapper can occur dos when using quine gzip file (CVE-2022-31628)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

The following packages have been upgraded to a later upstream version: php (8.1.14).

Security Fix(es):

• XKCP: buffer overflow in the SHA-3 reference implementation (CVE-2022-37454)
• php: standard insecure cookie could be treated as a '__Host-' or '__Secure-' cookie by PHP applications (CVE-2022-31629)
• php: OOB read due to insufficient input validation in imageloadfont() (CVE-2022-31630)
• php: PDO::quote() may return unquoted string due to an integer overflow (CVE-2022-31631)
• php: phar: infinite loop when decompressing quine gzip file (CVE-2022-31628)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

The following packages have been upgraded to a later upstream version: php (7.4.33).

Security Fix(es):

• XKCP: buffer overflow in the SHA-3 reference implementation (CVE-2022-37454)
• php: standard insecure cookie could be treated as a '__Host-' or '__Secure-' cookie by PHP applications (CVE-2022-31629)
• php: OOB read due to insufficient input validation in imageloadfont() (CVE-2022-31630)
• php: PDO::quote() may return unquoted string due to an integer overflow (CVE-2022-31631)
• php: phar: infinite loop when decompressing quine gzip file (CVE-2022-31628)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to execute arbitrary code or eliminate expected cryptographic properties. This occurs in the sponge function interface.

The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to execute arbitrary code or eliminate expected cryptographic properties. This occurs in the sponge function interface.

The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to execute arbitrary code or eliminate expected cryptographic properties. This occurs in the sponge function interface.

The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to execute arbitrary code or eliminate expected cryptographic properties. This occurs in the sponge function interface.

The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to execute arbitrary code or eliminate expected cryptographic properties. This occurs in the sponge function interface.

The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to execute arbitrary code or eliminate expected cryptographic properties. This occurs in the sponge function interface.

• CVE-2022-37454: Fix buffer overflow in the Keccak XKCP SHA-3 reference implementation
• CVE-2022-31630: Fix OOB read due to insufficient input validation in imageloadfont()
• CVE-2021-21707: Fix improper handlig of special character which breaks path in xml parsing

• CVE-2022-37454: Fix buffer overflow in the Keccak XKCP SHA-3 reference implementation
• CVE-2022-31630: Fix OOB read due to insufficient input validation in imageloadfont()
• CVE-2021-21707: Fix improper handlig of special character which breaks path in xml parsing

• CVE-2021-21702: fix NULL pointer dereference in SoapClient
• CVE-2021-21703: fix OOB R/W in root process leading to privilege escalation
• CVE-2022-31625: don't free uninitialized parameters in pg_query_params/pg_send_execute that have led to RCE
• CVE-2022-31626: fix mysqlnd/pdo password of excessive length triggering buffer overflow leading to RCE
• CVE-2022-31630: fix OOB read due to insufficient input validation in imageloadfont()
• CVE-2022-37454: fix buffer overflow in the Keccak XKCP SHA-3 reference implementation
• CVE-2023-0662: fix DoS vulnerability when parsing multipart request body

• CVE-2022-37454: port xkcp fix for buffer overflows in the bundled sha-3 keccak sponge implementation

The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to execute arbitrary code or eliminate expected cryptographic properties. This occurs in the sponge function interface.

These are all security issues fixed in the python38-3.8.15-3.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the php7-7.4.33-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python39-3.9.16-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python310-3.10.9-1.1 package on the GA media of openSUSE Tumbleweed.

The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to execute arbitrary code or eliminate expected cryptographic properties. This occurs in the sponge function interface.

This update for python3 fixes the following issues:

• CVE-2022-37454: Fixed a buffer overflow in hashlib.sha3_* implementations. (bsc#1204577)
• CVE-2020-10735: Fixed a bug to limit amount of digits converting text to int and vice vera. (bsc#1203125)

This update for php7 fixes the following issues:

• Version update to 7.4.33:

• CVE-2022-31630: Fixed out-of-bounds read due to insufficient input validation in imageloadfont() (bsc#1204979).

• CVE-2022-37454: Fixed buffer overflow in hash_update() on long parameter (bsc#1204577).

• Version update to 7.4.32 (jsc#SLE-23639)

• CVE-2022-31628: Fixed an uncontrolled recursion in the phar uncompressor while decompressing 'quines' gzip files. (bsc#1203867)

• CVE-2022-31629: Fixed a bug which could lead an attacker to set an insecure cookie that will treated as secure in the victim's browser. (bsc#1203870)

This update for php8 fixes the following issues:

• CVE-2022-37454: Fixed buffer overflow in hash_update() on long parameter (bug#81738) (bsc#1204577).

• CVE-2022-31630: Fixed OOB read due to insufficient input validation in imageloadfont() (bug#81739) (bsc#1204979).

• version update to 8.0.25 (27 Oct 2022)

  • Session: Fixed bug GH-9583 (session_create_id() fails with user defined save handler that doesn't have a validateId() method).
  • Streams: Fixed bug GH-9590 (stream_select does not abort upon exception or empty valid fd set).

This update for php7 fixes the following issues:

• Version update to 7.2.34 [jsc#SLE-23639]

• CVE-2022-37454: Fixed SHA-3 buffer overflow (bsc#1204577).

• Fix integer overflow in PHP_SHA3##bits (bsc#1204577#c26).