| Package | Affected versions | Patched versions |
|---|---|---|
| pysha3 | ≤ 1.0.2 | |
| sha3 | < 1.0.5 | 1.0.5 |
| php | ≥ 7.2.0, < 7.4.33≥ 8.0.0, < 8.0.25≥ 8.1.0, < 8.1.12 | 7.4.338.0.258.1.12 |
| pypy | ≥ 7.0.0 | |
| python | ≥ 3.10.0, < 3.10.9≥ 3.6.0, < 3.7.16≥ 3.8.0, < 3.8.16≥ 3.9.0, < 3.9.16 | 3.10.93.7.163.8.163.9.16 |
| sha3 | < 1.0.5 | 1.0.5 |
The Keccak sponge function interface accepts partial inputs to be absorbed and partial outputs to be squeezed. A buffer can overflow when partial data with some specific sizes are queued, where at least one of them has a length of 2^32 - 200 bytes or more.
Yes, see commit fdc6fef0.
The problem can be avoided by limiting the size of the partial input data (or partial output digest) below 2^32 - 200 bytes. Multiple calls to the queue system can be chained at a higher level to retain the original functionality. Alternatively, one can process the entire input (or produce the entire output) at once, avoiding the queuing functions altogether.
See issue #105 for more details.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free