The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 7.4.33, 8.0.25, 8.1.12, 3.7.16, 3.8.16, and 3 more
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: poc
- Automatable: yes
- Technical impact: total
Summary
The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to execute arbitrary code or eliminate expected cryptographic properties. This occurs in the sponge function interface.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: poc · Automatable: yes · Technical impact: total
- Record last updated
Affected versions
- libphpBitnami
From 7.2.0 · fixed in 7.4.33; From 8.0.0 · fixed in 8.0.25; From 8.1.0 · fixed in 8.1.12
- libpythonBitnami
From 3.6.0 · fixed in 3.7.16; From 3.8.0 · fixed in 3.8.16; From 3.9.0 · fixed in 3.9.16; From 3.10.0 · fixed in 3.10.9
- phpBitnami
From 7.2.0 · fixed in 7.4.33; From 8.0.0 · fixed in 8.0.25; From 8.1.0 · fixed in 8.1.12
- php-minBitnami
From 7.2.0 · fixed in 7.4.33; From 8.0.0 · fixed in 8.0.25; From 8.1.0 · fixed in 8.1.12
- pythonBitnami
From 3.6.0 · fixed in 3.7.16; From 3.8.0 · fixed in 3.8.16; From 3.9.0 · fixed in 3.9.16; From 3.10.0 · fixed in 3.10.9
- python-minBitnami
From 3.6.0 · fixed in 3.7.16; From 3.8.0 · fixed in 3.8.16; From 3.9.0 · fixed in 3.9.16; From 3.10.0 · fixed in 3.10.9
- pysha3PyPI
through 1.0.2
- sha3RubyGems
fixed in 1.0.5