CVE-2022-37454
published 2022-10-21CVE-2022-37454: The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to execute arbitrary…
PriorityP260critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
7.41%
94.4th percentile
The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to execute arbitrary code or eliminate expected cryptographic properties. This occurs in the sponge function interface.
Affected
27 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | php7.4 | < php7.4 7.4.33-1+deb11u1 (bullseye) | php7.4 7.4.33-1+deb11u1 (bullseye) |
| debian | pypy3 | < php7.4 7.4.33-1+deb11u1 (bullseye) | php7.4 7.4.33-1+deb11u1 (bullseye) |
| debian | pysha3 | < php7.4 7.4.33-1+deb11u1 (bullseye) | php7.4 7.4.33-1+deb11u1 (bullseye) |
| debian | python2.7 | < php7.4 7.4.33-1+deb11u1 (bullseye) | php7.4 7.4.33-1+deb11u1 (bullseye) |
| debian | python3.9 | < php7.4 7.4.33-1+deb11u1 (bullseye) | php7.4 7.4.33-1+deb11u1 (bullseye) |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| msrc | cbl2_php_8.1.12-1_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_python3_3.9.14-5_on_cbl_mariner_2.0 | — | — |
| msrc | cbl_mariner_1.0_arm | — | — |
| msrc | cbl_mariner_1.0_x64 | — | — |
| msrc | cbl_mariner_2.0_arm | — | — |
| msrc | cbl_mariner_2.0_x64 | — | — |
| msrc | cm1_python3_3.7.13-5_on_cbl_mariner_1.0 | — | — |
| paloalto | pan-os | — | — |
| php | php | >= 7.2.0 < 7.4.33 | 7.4.33 |
| php | php | >= 8.0.0 < 8.0.25 | 8.0.25 |
| php | php | >= 8.1.0 < 8.1.12 | 8.1.12 |
| pypy | pypy | >= 7.0.0 | — |
| python | python | >= 3.10.0 < 3.10.9 | 3.10.9 |
| python | python | >= 3.6.0 < 3.7.16 | 3.7.16 |
| python | python | >= 3.8.0 < 3.8.16 | 3.8.16 |
| python | python | >= 3.9.0 < 3.9.16 | 3.9.16 |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
osv9.8CRITICAL
vendor_debian9.8CRITICAL
vendor_msrc9.8CRITICAL
vendor_oracle9.8CRITICAL
vendor_redhat9.8CRITICAL
vendor_ubuntu9.8CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Buffer overflow in sponge queue functions
osv·2023-04-26
CVE-2022-37454 [CRITICAL] Buffer overflow in sponge queue functions
Buffer overflow in sponge queue functions
### Impact
The Keccak sponge function interface accepts partial inputs to be absorbed and partial outputs to be squeezed. A buffer can overflow when partial data with some specific sizes are queued, where at least one of them has a length of 2^32 - 200 bytes or more.
### Patches
Yes, see commit [fdc6fef0](https://github.com/XKCP/XKCP/commit/fdc6fef075f4e81d6b1bc38364248975e08e340a).
### Workarounds
The problem can be avoided by limiting the size of the partial input data (or partial output digest) below 2^32 - 200 bytes. Multiple calls to the queue system can be chained at a higher level to retain the original functionality. Alternatively, one can process the entire input (or produce the entire output) at once, avoiding the queuing functions
GHSA
Buffer overflow in sponge queue functions
ghsa·2023-04-26
CVE-2022-37454 [CRITICAL] CWE-190 Buffer overflow in sponge queue functions
Buffer overflow in sponge queue functions
### Impact
The Keccak sponge function interface accepts partial inputs to be absorbed and partial outputs to be squeezed. A buffer can overflow when partial data with some specific sizes are queued, where at least one of them has a length of 2^32 - 200 bytes or more.
### Patches
Yes, see commit [fdc6fef0](https://github.com/XKCP/XKCP/commit/fdc6fef075f4e81d6b1bc38364248975e08e340a).
### Workarounds
The problem can be avoided by limiting the size of the partial input data (or partial output digest) below 2^32 - 200 bytes. Multiple calls to the queue system can be chained at a higher level to retain the original functionality. Alternatively, one can process the entire input (or produce the entire output) at once, avoiding the queuing functions
OSV
python3.8 vulnerability
osv·2023-03-07·CVSS 9.8
CVE-2022-37454 [CRITICAL] python3.8 vulnerability
python3.8 vulnerability
It was discovered that Python incorrectly handled certain inputs. If a
user or an automated system were tricked into running a specially
crafted input, a remote attacker could possibly use this issue to execute
arbitrary code. (CVE-2022-37454)
OSV
python3.7 vulnerability
osv·2023-03-07·CVSS 9.8
CVE-2022-37454 [CRITICAL] python3.7 vulnerability
python3.7 vulnerability
It was discovered that Python incorrectly handled certain inputs. If a
user or an automated system were tricked into running a specially
crafted input, a remote attacker could possibly use this issue to execute
arbitrary code. (CVE-2022-37454)
OSV
python3.6 vulnerability
osv·2023-03-06·CVSS 9.8
CVE-2022-37454 [CRITICAL] python3.6 vulnerability
python3.6 vulnerability
USN-5767-1 fixed vulnerabilities in Python. This update fixes the problem
for Ubuntu 18.04 LTS.
Original advisory details:
Nicky Mouha discovered that Python incorrectly handled certain SHA-3 internals.
An attacker could possibly use this issue to cause a crash or execute arbitrary code.
(CVE-2022-37454)
OSV
python3.9 vulnerabilities
osv·2023-02-27·CVSS 7.6
CVE-2015-20107 [HIGH] python3.9 vulnerabilities
python3.9 vulnerabilities
It was discovered that Python incorrectly handled certain inputs. If a
user or an automated system were tricked into opening a specially
crafted input file, a remote attacker could possibly use this issue to
execute arbitrary code. (CVE-2015-20107)
Hamza Avvan discovered that Python incorrectly handled certain inputs. If a
user or an automated system were tricked into running a specially
crafted input, a remote attacker could possibly use this issue to execute
arbitrary code. (CVE-2021-28861)
It was discovered that Python incorrectly handled certain inputs. If a
user or an automated system were tricked into running a specially
crafted input, a remote attacker could possibly use this issue to execute
arbitrary code. (CVE-2022-37454, CVE-2022-42919)
It was disco
OSV
python2.7, python3.10, python3.6, python3.8 vulnerabilities
osv·2022-12-08·CVSS 9.8
CVE-2022-37454 [CRITICAL] python2.7, python3.10, python3.6, python3.8 vulnerabilities
python2.7, python3.10, python3.6, python3.8 vulnerabilities
Nicky Mouha discovered that Python incorrectly handled certain SHA-3 internals.
An attacker could possibly use this issue to cause a crash or execute arbitrary code.
(CVE-2022-37454)
It was discovered that Python incorrectly handled certain IDNA inputs.
An attacker could possibly use this issue to expose sensitive information
denial of service, or cause a crash.
(CVE-2022-45061)
OSV
php7.2, php7.4, php8.1 vulnerabilities
osv·2022-11-08·CVSS 5.5
CVE-2022-31628 [MEDIUM] php7.2, php7.4, php8.1 vulnerabilities
php7.2, php7.4, php8.1 vulnerabilities
It was discovered that PHP incorrectly handled certain gzip files.
An attacker could possibly use this issue to cause a denial of service.
(CVE-2022-31628)
It was discovered that PHP incorrectly handled certain cookies.
An attacker could possibly use this issue to compromise the data
(CVE-2022-31629)
It was discovered that PHP incorrectly handled certain image fonts.
An attacker could possibly use this issue to expose sensitive information.
This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.10, and Ubuntu 22.04 LTS.
(CVE-2022-31630)
Nicky Mouha discovered that PHP incorrectly handled certain SHA-3 operations.
An attacker could possibly use this issue to cause a crash
or execute arbitrary code. This issue only affected Ubuntu 20.04 LTS,
Ubuntu 22
OSV
CVE-2022-37454: The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to execute a
osv·2022-10-21·CVSS 9.8
CVE-2022-37454 [CRITICAL] CVE-2022-37454: The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to execute a
The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to execute arbitrary code or eliminate expected cryptographic properties. This occurs in the sponge function interface.
Palo Alto
PAN-SA-2024-0004 Informational Bulletin: OSS CVEs fixed in PAN-OS
vendor_paloalto·2024-04-10·CVSS 9.8
CVE-2015-5739 [CRITICAL] PAN-SA-2024-0004 Informational Bulletin: OSS CVEs fixed in PAN-OS
PAN-SA-2024-0004 Informational Bulletin: OSS CVEs fixed in PAN-OS
The Palo Alto Networks Product Security Assurance team has evaluated the following open source software (OSS) CVEs as they relate to PAN-OS. While it was not determined that these CVEs have any significant impact on PAN-OS, they have been fixed out of an abundance of caution. CVE Summary CVE-2015-5739 This CVE is fixed in PAN-OS 11.0.4, and all later PAN-OS versions. CVE-2016-10228 This CVE is fixed in PAN-OS 11.1.3, and all later PAN-OS versions. CVE-2017-8923 This CVE is fixed in PAN-OS 10.2.8, 11.0.3, and all later PAN-OS versions. CVE-2017-9120 This CVE is fixed in PAN-OS 10.2.8, 11.0.3, and all later PAN-OS versions. CVE-2018-25009 This CVE is fixed in PAN-OS 10.2.8, 11.0.4, 11.1.3, and all later PAN-OS versions. CVE-2
CISA ICS
Siemens SCALANCE XCM-/XRM-300
cisa_ics·2024-02-15
Siemens SCALANCE XCM-/XRM-300
ICS Advisory
##
Siemens SCALANCE XCM-/XRM-300
Release DateFebruary 15, 2024
Alert CodeICSA-24-046-11
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global).
View CSAF
## 1. EXECUTIVE SUMMARY
- CVSS v3 9.8
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Siemens
- Equipment: SCALANCE XCM-/XRM-300
- Vulnerabilities: Out-of-bounds Write, Incorrect Type Conversion or Cast, Improper Verification of Cryptographic Signature, Improper Access Control, Improper Authentication, Missing Encryption
Palo Alto
PAN-SA-2024-0001 Informational Bulletin: Impact of OSS CVEs in PAN-OS
vendor_paloalto·2024-02-14·CVSS 9.8
CVE-2017-18342 [CRITICAL] PAN-SA-2024-0001 Informational Bulletin: Impact of OSS CVEs in PAN-OS
PAN-SA-2024-0001 Informational Bulletin: Impact of OSS CVEs in PAN-OS
The Palo Alto Networks Product Security Assurance team has evaluated the following open source software (OSS) CVEs as they relate to PAN-OS software. While PAN-OS software may include the
CVEs: CVE-2017-18342, CVE-2017-8923, CVE-2017-9120, CVE-2019-1551, CVE-2019-16865, CVE-2019-16905, CVE-2019-19523, CVE-2019-19528, CVE-2019-19911, CVE-2020-0404, CVE-2020-0431, CVE-2020-0466, CVE-2020-10379, CVE-2020-11538, CVE-2020-11608, CVE-2020-12114, CVE-2020-12321, CVE-2020-12362, CVE-2020-12363, CVE-2020-12364, CVE-2020-13757, CVE-2020-14314, CVE-2020-14351, CVE-2020-15778, CVE-2020-1967, CVE-2020-24394, CVE-2020-24504, CVE-2020-25211, CVE-2020-25212, CVE-2020-25284, CVE-2020-25285, CVE-2020-25717, CVE-2020-26541, CVE-2020-2715
Ubuntu
PyPy vulnerability
vendor_ubuntu·2023-11-29
CVE-2022-37454 PyPy vulnerability
Title: PyPy vulnerability
Summary: PyPy could be made to crash or run programs if it received specially
crafted data.
Nicky Mouha discovered that PyPy incorrectly handled certain SHA-3
operations. An attacker could possibly use this issue to cause PyPy to
crash, resulting in a denial of service, or possibly execute arbitrary
code.
Instructions: In general, a standard system update will make all the necessary changes.
Ubuntu
pysha3 vulnerability
vendor_ubuntu·2023-11-29
CVE-2022-37454 pysha3 vulnerability
Title: pysha3 vulnerability
Summary: pysha3 could be made to crash or run programs if it received specially
crafted data.
Nicky Mouha discovered that pysha incorrectly handled certain SHA-3
operations. An attacker could possibly use this issue to cause pysha3 to
crash, resulting in a denial of service, or possibly execute arbitrary
code.
Instructions: In general, a standard system update will make all the necessary changes.
Ubuntu
Python vulnerability
vendor_ubuntu·2023-03-07·CVSS 9.8
CVE-2022-37454 [CRITICAL] Python vulnerability
Title: Python vulnerability
Summary: Several security issues were fixed in Python.
It was discovered that Python incorrectly handled certain inputs. If a
user or an automated system were tricked into running a specially
crafted input, a remote attacker could possibly use this issue to execute
arbitrary code. (CVE-2022-37454)
Instructions: In general, a standard system update will make all the necessary changes.
Ubuntu
Python vulnerability
vendor_ubuntu·2023-03-06·CVSS 9.8
CVE-2022-37454 [CRITICAL] Python vulnerability
Title: Python vulnerability
Summary: Several security issues were fixed in Python.
USN-5767-1 fixed vulnerabilities in Python. This update fixes the problem
for Ubuntu 18.04 LTS.
Original advisory details:
Nicky Mouha discovered that Python incorrectly handled certain SHA-3 internals.
An attacker could possibly use this issue to cause a crash or execute arbitrary code.
(CVE-2022-37454)
Instructions: In general, a standard system update will make all the necessary changes.
Ubuntu
Python vulnerabilities
vendor_ubuntu·2023-02-27·CVSS 7.6
CVE-2022-42919 [HIGH] Python vulnerabilities
Title: Python vulnerabilities
Summary: Several security issues were fixed in Python.
It was discovered that Python incorrectly handled certain inputs. If a
user or an automated system were tricked into opening a specially
crafted input file, a remote attacker could possibly use this issue to
execute arbitrary code. (CVE-2015-20107)
Hamza Avvan discovered that Python incorrectly handled certain inputs. If a
user or an automated system were tricked into running a specially
crafted input, a remote attacker could possibly use this issue to execute
arbitrary code. (CVE-2021-28861)
It was discovered that Python incorrectly handled certain inputs. If a
user or an automated system were tricked into running a specially
crafted input, a remote attacker could possibly use this issue to execute
ar
Oracle
Oracle Oracle Communications Applications Risk Matrix: User Interface (PHP) — CVE-2022-37454
vendor_oracle·2023-01-15·CVSS 9.8
CVE-2022-37454 [CRITICAL] Oracle Oracle Communications Applications Risk Matrix: User Interface (PHP) — CVE-2022-37454
Oracle Oracle Communications Applications Risk Matrix: User Interface (PHP) vulnerability
CVE: CVE-2022-37454
CVSS: 9.8
Protocol: HTTPS
Remote exploit: Yes
Affected versions: Network
Advisory: cpujan2023 (JAN 2023)
Ubuntu
Python vulnerabilities
vendor_ubuntu·2022-12-08·CVSS 9.8
CVE-2022-45061 [CRITICAL] Python vulnerabilities
Title: Python vulnerabilities
Summary: Several security issues were fixed in Python.
Nicky Mouha discovered that Python incorrectly handled certain SHA-3 internals.
An attacker could possibly use this issue to cause a crash or execute arbitrary code.
(CVE-2022-37454)
It was discovered that Python incorrectly handled certain IDNA inputs.
An attacker could possibly use this issue to expose sensitive information
denial of service, or cause a crash.
(CVE-2022-45061)
Instructions: In general, a standard system update will make all the necessary changes.
Ubuntu
PHP vulnerabilities
vendor_ubuntu·2022-11-08·CVSS 2.3
CVE-2022-31630 [LOW] PHP vulnerabilities
Title: PHP vulnerabilities
Summary: Several security issues were fixed in PHP.
It was discovered that PHP incorrectly handled certain gzip files.
An attacker could possibly use this issue to cause a denial of service.
(CVE-2022-31628)
It was discovered that PHP incorrectly handled certain cookies.
An attacker could possibly use this issue to compromise the data
(CVE-2022-31629)
It was discovered that PHP incorrectly handled certain image fonts.
An attacker could possibly use this issue to expose sensitive information.
This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.10, and Ubuntu 22.04 LTS.
(CVE-2022-31630)
Nicky Mouha discovered that PHP incorrectly handled certain SHA-3 operations.
An attacker could possibly use this issue to cause a crash
or execute arbitrary code. This issue
Red Hat
XKCP: buffer overflow in the SHA-3 reference implementation
vendor_redhat·2022-10-20·CVSS 9.8
CVE-2022-37454 [CRITICAL] CWE-680 XKCP: buffer overflow in the SHA-3 reference implementation
XKCP: buffer overflow in the SHA-3 reference implementation
The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to execute arbitrary code or eliminate expected cryptographic properties. This occurs in the sponge function interface.
A flaw was found in the Keccak XKCP SHA-3 reference implementation. The sponge function interface allows partial input data to be processed, and partial output to be produced. When at least one of these has a length of 4294967096 bytes or more, it can result in elimination of cryptographic properties, execution of arbitrary code, or a denial of service.
Statement: Python as shipped with Red Hat Red Hat Enterprise Linux is not affected by this flaw as it uses the OpenSSL SHA-
Microsoft
The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to execute arbitrary code or eliminate expected cryptographic
vendor_msrc·2022-10-11·CVSS 9.8
CVE-2022-37454 [CRITICAL] CWE-190 The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to execute arbitrary code or eliminate expected cryptographic
The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to execute arbitrary code or eliminate expected cryptographic properties. This occurs in the sponge function interface.
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact
Debian
CVE-2022-37454: php7.4 - The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer ove...
vendor_debian·2022·CVSS 9.8
CVE-2022-37454 [CRITICAL] CVE-2022-37454: php7.4 - The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer ove...
The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to execute arbitrary code or eliminate expected cryptographic properties. This occurs in the sponge function interface.
Scope: local
bullseye: resolved (fixed in 7.4.33-1+deb11u1)
No detection rules found.
No public exploits indexed.
arXiv
Unveiling Security Weaknesses in Autonomous Driving Systems: An In-Depth Empirical Study
arxiv_fulltext·2025-02-27
Unveiling Security Weaknesses in Autonomous Driving Systems: An In-Depth Empirical Study
sloppypar
1
.001
Unveiling Security Weaknesses in Autonomous Driving Systems
Z Li et al.
[mode = title]Unveiling Security Weaknesses in Autonomous Driving Systems: An In-Depth Empirical Study
[1]Wenyuan Cheng
[email protected]
Conceptualization, Methodology, Investigation, Data curation, Writing - Original draft preparation
[1]School of Computer Science & Hubei Provincial Key Laboratory of Artificial Intelligence and Smart Learning, \ China Normal University, Wuhan, China
[1]Zengyang Li
[1]
[email protected]
Conceptualization, Methodology, Investigation, Data curation, Writing - Original draft preparation
[2]Peng Liang
[email protected]
Conceptualization, Methodology, Writing - Original draft preparation
[2]School of Computer Science, Wuhan University, Wuhan, China
arXiv
Free Proxies Unmasked: A Vulnerability and Longitudinal Analysis of Free Proxy Services
arxiv_fulltext·2024-03-04
Free Proxies Unmasked: A Vulnerability and Longitudinal Analysis of Free Proxy Services
cyanrgb0.4,1,1
orangergb1,0.7,0
dkgreenrgb0,0.6,0
grayrgb0.5,0.5,0.5
purplergb0.58,0,0.82
[3]#1#2: #3
[1]redTODO: #1
redREFS
[1]brownAntoine#1
[1]orangePierre#1
[1]magentaNaif#1
[1]purpleWalter#1
[1]dkgreen#1
[1]orange#1
[1]red#1
[1]#1
[1]#1
[1]#1
[1]3pt plus 1pt minus 1pt #1.75em minus .5em
et al.
i.e.,\
e.g.,\
black!60whiteRedacted
Datadome
Free Proxies Unmasked: A Vulnerability and Longitudinal Analysis of Free Proxy Services
Anonymous Authors*
Naif Mehanna
Univ. Lille, Inria, CNRS
[email protected]
Walter Rudametkin
Univ. Rennes, Inria,
CNRS, IRISA, IUF
[email protected]
Pierre Laperdrix
CNRS, Univ. Lille, Inria
[email protected]
Antoine Vastel
Datadome
[email protected]
\@IEEEpubidpullup6.5
7.57.5 Workshop on Measurements, Attac
https://csrc.nist.gov/projects/hash-functions/sha-3-projecthttps://eprint.iacr.org/2023/331https://github.com/XKCP/XKCP/security/advisories/GHSA-6w4m-2xhg-2658https://lists.debian.org/debian-lts-announce/2022/10/msg00041.htmlhttps://lists.debian.org/debian-lts-announce/2022/11/msg00000.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3ALQ6BDDPX5HU5YBQOBMDVAA2TSGDKIJ/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CMIEXLMTW5GO36HTFFWIPB3OHZXCT3G4/https://mouha.be/sha-3-buffer-overflow/https://news.ycombinator.com/item?id=33281106https://news.ycombinator.com/item?id=35050307https://security.gentoo.org/glsa/202305-02https://www.debian.org/security/2022/dsa-5267https://www.debian.org/security/2022/dsa-5269https://csrc.nist.gov/projects/hash-functions/sha-3-projecthttps://eprint.iacr.org/2023/331https://github.com/XKCP/XKCP/security/advisories/GHSA-6w4m-2xhg-2658https://lists.debian.org/debian-lts-announce/2022/10/msg00041.htmlhttps://lists.debian.org/debian-lts-announce/2022/11/msg00000.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3ALQ6BDDPX5HU5YBQOBMDVAA2TSGDKIJ/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CMIEXLMTW5GO36HTFFWIPB3OHZXCT3G4/https://mouha.be/sha-3-buffer-overflow/https://news.ycombinator.com/item?id=33281106https://news.ycombinator.com/item?id=35050307https://security.gentoo.org/glsa/202305-02https://security.netapp.com/advisory/ntap-20230203-0001/https://www.debian.org/security/2022/dsa-5267https://www.debian.org/security/2022/dsa-5269https://cert-portal.siemens.com/productcert/html/ssa-398330.htmlhttps://cert-portal.siemens.com/productcert/html/ssa-455250.htmlhttps://cert-portal.siemens.com/productcert/html/ssa-806742.html
2022-10-21
Published