Critical · published October 21, 2022
🔥 A seemingly harmless integer overflow leads to a catastrophic buffer overflow in the Keccak SHA-3 implementation! Think of this as a production line that's designed to handle a certain number of items. If someone sneaks in and overloads the system, it doesn't just jam up—it could break down entirely and release anything stored within. An attacker exploiting this vulnerability could execute arbitrary code, potentially compromising sensitive cryptographic processes—like letting a fox into a henhouse! This not only threatens the integrity of the cryptographic properties but could lead to devastating data breaches.
Think of this as a production line that's designed to handle a certain number of items. If someone sneaks in and overloads the system, it doesn't just jam up—it could break down entirely and release anything stored within. The vulnerability arises from an integer overflow in the sponge function interface, which results in a buffer overflow, allowing attackers to manipulate the execution flow and potentially execute arbitrary code.
An attacker exploiting this vulnerability could execute arbitrary code, potentially compromising sensitive cryptographic processes—like letting a fox into a henhouse! This not only threatens the integrity of the cryptographic properties but could lead to devastating data breaches. To safeguard your systems, patch to version fdc6fef or newer immediately. Ensure your cryptographic libraries are up-to-date and conduct a thorough review of your implementation to avoid any potential misuse. You’ve got this—stay vigilant, follow the steps, and you'll keep your cryptographic fortress secure! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| extended_keccak_code_package_project/extended_keccak_code_package | all versions | — |
| debian/debian_linux | all versions | — |
| debian/debian_linux | all versions | — |
| fedoraproject/fedora | all versions | — |
| fedoraproject/fedora | all versions | — |
| php/php | ≥ 7.2.0, < 7.4.33 | 7.4.33 |
| php/php | ≥ 8.0.0, < 8.0.25 | 8.0.25 |
| php/php | ≥ 8.1.0, < 8.1.12 | 8.1.12 |
| python/python | ≥ 3.6.0, < 3.7.16 | 3.7.16 |
| python/python | ≥ 3.8.0, < 3.8.16 | 3.8.16 |
| python/python | ≥ 3.9.0, < 3.9.16 | 3.9.16 |
| python/python | ≥ 3.10.0, < 3.10.9 | 3.10.9 |
| sha3_project/sha3 | < 1.0.5 | 1.0.5 |
| pysha3_project/pysha3 | all versions | — |
| pypy/pypy | ≥ 7.0.0 | — |