CVE-2022-37454

A flaw was found in the Keccak XKCP SHA-3 reference implementation. The sponge function interface allows partial input data to be processed, and partial output to be produced. When at least one of these has a length of 4294967096 bytes or more, it can result in elimination of cryptographic properties, execution of arbitrary code, or a denial of service.

Python as shipped with Red Hat Red Hat Enterprise Linux is not affected by this flaw as it uses the OpenSSL SHA-3 implementation.

PHP as shipped with Red Hat Enterprise Linux is affected but not vulnerable by default as it depends of the memory_limit[1] configuration setting to have a value of -1, indicating there is no limit, or to a value bigger than 4G. These values are very unlikely and to reflect this condition PHP was rated with a moderate security impact.

[1]. https://www.php.net/manual/en/ini.core.php#ini.memory-limit

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Library users can limit the size of partial input data or partial output digest to below 4294967096 bytes. Avoiding the queuing functions altogether by processing the entire input or producing the entire output at once does not trigger this vulnerability.