CVE-2022-37454: https://mouha.be/sha-3-buffer-overflow/ https://github.com/XKCP/XKCP/security/advisories/GHSA-6w4m-2xhg-2658 The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to execute arbitrary code or eliminate expected cryptographic properties. This occurs in the sponge function interface. Fixed in 3.11, with a PR linked for 3.10.
I'm not 100% sure but I think modern versions of dev-lang/python[ssl] use the SHA3 implementation from OpenSSL in hashlib.
So unless I'm mistaken: - 3.8 only uses bundled code = vulnerable - 3.9 and 3.10 defaults to OpenSSL = not vulnerable in the default configuration
As I've said, 3.9 and 3.10 are unlikely to be vulnerable in Gentoo builds but I've backported the fixes (along with one other security fix) anyway.
cleanup done
Heh, pypy3 seems to bundle this one too.
Thank you!
Please cleanup.
pypy3 cleanup done too.
Thanks!
GLSA requested
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/data/glsa.git/commit/?id=721dfacf17914fe5f7bfa3d0b401379d6318f7b1 commit 721dfacf17914fe5f7bfa3d0b401379d6318f7b1 Author: GLSAMaker <glsamaker@gentoo.org> AuthorDate: 2023-05-03 09:12:43 +0000 Commit: Sam James <sam@gentoo.org> CommitDate: 2023-05-03 09:31:45 +0000 [ GLSA 202305-02 ] Python, PyPy3: Multiple Vulnerabilities Bug: https://bugs.gentoo.org/787260 Bug: https://bugs.gentoo.org/793833 Bug: https://bugs.gentoo.org/811165 Bug: https://bugs.gentoo.org/834533 Bug: https://bugs.gentoo.org/835443 Bug: https://bugs.gentoo.org/838250 Bug: https://bugs.gentoo.org/864747 Bug: https://bugs.gentoo.org/876815 Bug: https://bugs.gentoo.org/877851 Bug: https://bugs.gentoo.org/878385 Bug: https://bugs.gentoo.org/880629 Signed-off-by: GLSAMaker <glsamaker@gentoo.org> Signed-off-by: Sam James <sam@gentoo.org> glsa-202305-02.xml | 107 +++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 107 insertions(+)