CVE-2022-37454
CVE-2022-37454
Vexday Risk Score
28Baixo
Decisão SSVC (CISA)
Track
Sem sinal de exploração → monitorar
CVSS 9.8EPSS 5.2%KEV nãoPoC —Nuclei —Metasploit —Patch —
Ciclo de vida
21 out 2022Publicada no NVD
Recomendação: Monitorar — sem sinal de exploração no momento.
The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to execute arbitrary code or eliminate expected cryptographic properties. This occurs in the sponge function interface.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
n/a · n/aQuer saber se a sua infraestrutura está exposta a isto?
Falar com a TrueHacking →Referências
https://csrc.nist.gov/projects/hash-functions/sha-3-projecthttps://eprint.iacr.org/2023/331https://github.com/XKCP/XKCP/security/advisories/GHSA-6w4m-2xhg-2658https://lists.debian.org/debian-lts-announce/2022/10/msg00041.htmlhttps://lists.debian.org/debian-lts-announce/2022/11/msg00000.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3ALQ6BDDPX5HU5YBQOBMDVAA2TSGDKIJ/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CMIEXLMTW5GO36HTFFWIPB3OHZXCT3G4/https://mouha.be/sha-3-buffer-overflow/https://news.ycombinator.com/item?id=33281106https://news.ycombinator.com/item?id=35050307https://security.gentoo.org/glsa/202305-02https://security.netapp.com/advisory/ntap-20230203-0001/