CVE-2022-37454
28Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 9.8epss 5.7%
probabilidade de exploração
5.7%top 7% das CVEs
exploração observada
nãonenhuma fonte reporta
The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to execute arbitrary code or eliminate expected cryptographic properties. This occurs in the sponge function interface.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
n/a · n/aReferências
https://csrc.nist.gov/projects/hash-functions/sha-3-projecthttps://eprint.iacr.org/2023/331https://github.com/XKCP/XKCP/security/advisories/GHSA-6w4m-2xhg-2658https://lists.debian.org/debian-lts-announce/2022/10/msg00041.htmlhttps://lists.debian.org/debian-lts-announce/2022/11/msg00000.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3ALQ6BDDPX5HU5YBQOBMDVAA2TSGDKIJ/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CMIEXLMTW5GO36HTFFWIPB3OHZXCT3G4/https://mouha.be/sha-3-buffer-overflow/https://news.ycombinator.com/item?id=33281106https://news.ycombinator.com/item?id=35050307https://security.gentoo.org/glsa/202305-02https://security.netapp.com/advisory/ntap-20230203-0001/