Bug 877851 – <dev-lang/python-{3.{8,9}.15,3.10.8}_p1 <dev-python/pypy3-7.3.9_p8: SHA-3 buffer overflow

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description John Helmert III 2022-10-21 16:02:52 UTC]

CVE-2022-37454:
https://mouha.be/sha-3-buffer-overflow/
https://github.com/XKCP/XKCP/security/advisories/GHSA-6w4m-2xhg-2658

The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to execute arbitrary code or eliminate expected cryptographic properties. This occurs in the sponge function interface.

Fixed in 3.11, with a PR linked for 3.10.

[Comment 1 Michał Górny 2022-10-21 16:42:52 UTC]

I'm not 100% sure but I think modern versions of dev-lang/python[ssl] use the SHA3 implementation from OpenSSL in hashlib.

[Comment 2 Michał Górny 2022-10-21 18:50:08 UTC]

So unless I'm mistaken:

- 3.8 only uses bundled code = vulnerable
- 3.9 and 3.10 defaults to OpenSSL = not vulnerable in the default configuration

[Comment 3 Michał Górny 2022-10-26 15:57:23 UTC]

As I've said, 3.9 and 3.10 are unlikely to be vulnerable in Gentoo builds but I've backported the fixes (along with one other security fix) anyway.

[Comment 4 Michał Górny 2022-10-29 06:01:34 UTC]

cleanup done

[Comment 5 Michał Górny 2022-10-29 06:12:01 UTC]

Heh, pypy3 seems to bundle this one too.

[Comment 6 John Helmert III 2022-10-30 03:29:13 UTC]

Thank you!

[Comment 7 John Helmert III 2022-10-31 03:00:05 UTC]

Please cleanup.

[Comment 8 Michał Górny 2022-10-31 13:56:12 UTC]

pypy3 cleanup done too.

[Comment 9 John Helmert III 2022-11-01 03:53:53 UTC]

Thanks!

[Comment 10 John Helmert III 2022-11-19 01:15:53 UTC]

GLSA requested

[Comment 11 Larry the Git Cow 2023-05-03 09:31:52 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/data/glsa.git/commit/?id=721dfacf17914fe5f7bfa3d0b401379d6318f7b1

commit 721dfacf17914fe5f7bfa3d0b401379d6318f7b1
Author:     GLSAMaker <[e-mail]>
AuthorDate: 2023-05-03 09:12:43 +0000
Commit:     Sam James <[e-mail]>
CommitDate: 2023-05-03 09:31:45 +0000

    [ GLSA 202305-02 ] Python, PyPy3: Multiple Vulnerabilities
    
    Bug: https://bugs.gentoo.org/787260
    Bug: https://bugs.gentoo.org/793833
    Bug: https://bugs.gentoo.org/811165
    Bug: https://bugs.gentoo.org/834533
    Bug: https://bugs.gentoo.org/835443
    Bug: https://bugs.gentoo.org/838250
    Bug: https://bugs.gentoo.org/864747
    Bug: https://bugs.gentoo.org/876815
    Bug: https://bugs.gentoo.org/877851
    Bug: https://bugs.gentoo.org/878385
    Bug: https://bugs.gentoo.org/880629
    Signed-off-by: GLSAMaker <[e-mail]>
    Signed-off-by: Sam James <[e-mail]>

 glsa-202305-02.xml | 107 +++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 107 insertions(+)