blogsafe.org My Downloads

BlogSafe.org

PHP CVEs

Vulnerabilities in the PHP language itself, and which PHP versions they affect.

← Back to CVE list

CVE-2022-37454

CRITICAL 9.8 CVSS 3.1
Published
October 21, 2022
Last modified
October 14, 2026
NVD status
Modified
Reported by
cve@mitre.org
Weakness
CWE-190
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to execute arbitrary code or eliminate expected cryptographic properties. This occurs in the sponge function interface.

Affected products and versions

  • PHP — From 7.2.0 (including) to 7.4.33 (excluding)
  • PHP — From 8.0.0 (including) to 8.0.25 (excluding)
  • PHP — From 8.1.0 (including) to 8.1.12 (excluding)

References

  • csrc.nist.gov https://csrc.nist.gov/projects/hash-functions/sha-3-project Third Party Advisory, US Government Resource
  • eprint.iacr.org https://eprint.iacr.org/2023/331
  • github.com https://github.com/XKCP/XKCP/security/advisories/GHSA-6w4m-2xhg-2658 Patch, Third Party Advisory
  • lists.debian.org https://lists.debian.org/debian-lts-announce/2022/10/msg00041.html Mailing List, Third Party Advisory
  • lists.debian.org https://lists.debian.org/debian-lts-announce/2022/11/msg00000.html Mailing List, Third Party Advisory
  • lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3ALQ6BDDPX5HU5YBQOBMDVAA2TSGDKIJ/ Mailing List, Third Party Advisory
  • lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CMIEXLMTW5GO36HTFFWIPB3OHZXCT3G4/ Mailing List, Third Party Advisory
  • mouha.be https://mouha.be/sha-3-buffer-overflow/ Exploit, Third Party Advisory
  • news.ycombinator.com https://news.ycombinator.com/item?id=33281106 Issue Tracking, Third Party Advisory
  • news.ycombinator.com https://news.ycombinator.com/item?id=35050307
  • security.gentoo.org https://security.gentoo.org/glsa/202305-02
  • www.debian.org https://www.debian.org/security/2022/dsa-5267 Third Party Advisory
  • www.debian.org https://www.debian.org/security/2022/dsa-5269 Third Party Advisory
  • security.netapp.com https://security.netapp.com/advisory/ntap-20230203-0001/
  • cert-portal.siemens.com https://cert-portal.siemens.com/productcert/html/ssa-398330.html
  • cert-portal.siemens.com https://cert-portal.siemens.com/productcert/html/ssa-455250.html
  • cert-portal.siemens.com https://cert-portal.siemens.com/productcert/html/ssa-806742.html
  • nvd.nist.gov Official NVD record