CVE-2022-37454
The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to execute arbitrary code or…
Published Oct 21, 2022 · updated Oct 14, 2026 · extended keccak code package project extended keccak code package
The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to execute arbitrary code or eliminate expected cryptographic properties. This occurs in the sponge function interface.
Timeline
Detection, updates, and resolution for this record.
Oct 21, 2022 · NIST NVD
Detected
The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to execute arbitrary code or eliminate expected cryptographic properties. This occurs in the sponge function interface.
Oct 14, 2026 · NIST NVD
Updated
The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to execute arbitrary code or eliminate expected cryptographic properties. This occurs in the sponge function interface.
Affected
- cpe debian/debian linux10.0
- cpe debian/debian linux11.0
- cpe extended keccak code package project/extended keccak code packageversion unspecified
- cpe fedoraproject/fedora35
- cpe fedoraproject/fedora36
- cpe php/phpversion unspecified
- cpe pypy/pypyversion unspecified
- cpe pysha3 project/pysha3version unspecified
- cpe python/pythonversion unspecified
- cpe sha3 project/sha3version unspecified
Sources
- CVE.orgCVE-2022-37454
Official CVE identifier
cve.org - NIST NVDCVE-2022-37454
The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to execute arbitrary code or eliminate expected cryptographic properties. This occurs in the sponge function interface.
nvd.nist.gov