The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to execute arbitrary code or eliminate expected cryptographic properties. This occurs in the sponge function interface.
Fixed in 3.11, with a PR linked for 3.10.
I'm not 100% sure but I think modern versions of dev-lang/python[ssl] use the SHA3 implementation from OpenSSL in hashlib.
So unless I'm mistaken:
- 3.8 only uses bundled code = vulnerable
- 3.9 and 3.10 defaults to OpenSSL = not vulnerable in the default configuration
As I've said, 3.9 and 3.10 are unlikely to be vulnerable in Gentoo builds but I've backported the fixes (along with one other security fix) anyway.
Heh, pypy3 seems to bundle this one too.
pypy3 cleanup done too.
The bug has been referenced in the following commit(s):
Author: GLSAMaker <firstname.lastname@example.org>
AuthorDate: 2023-05-03 09:12:43 +0000
Commit: Sam James <email@example.com>
CommitDate: 2023-05-03 09:31:45 +0000
[ GLSA 202305-02 ] Python, PyPy3: Multiple Vulnerabilities
Signed-off-by: GLSAMaker <firstname.lastname@example.org>
Signed-off-by: Sam James <email@example.com>
glsa-202305-02.xml | 107 +++++++++++++++++++++++++++++++++++++++++++++++++++++
1 file changed, 107 insertions(+)