Vulnerable to CVE 2022-37454 (SHA-3 buffer overflow)

[Stefano Rivera]

pysha3, pypy3, python3.X are affected by CVE-2022-37454, a security issue in Keccak
https://mouha.be/sha-3-buffer-overflow/

See: https://github.com/python/cpython/issues/98517

Testing:

python3.X/pypy3:

import hashlib; h = hashlib.sha3_224(); h.update(b'\x01'); \
h.update(b'\x01'*0xffff_ffff); \
assert h.hexdigest() == '80762e8ce6700f114fec0f621fd97c4b9c00147fa052215294cceeed'

pysha3:

import sha3; h = sha3.sha3_224(); h.update(b'\x01'); \
h.update(b'\x01'*0xffff_ffff); \
assert h.hexdigest() == '80762e8ce6700f114fec0f621fd97c4b9c00147fa052215294cceeed'

For pypy3 and pysha3, I have:
1. Verified the issues exist in the current packages, with the above tests.
2. Built the packages with the attached patches
3. Verified that the packages upgrade
4. Verified the security issues are resolved, with the above tests.

[Steve Beattie (sbeattie)]

Hey Stefano, thanks for preparing the debdiffs for pypy3 and pysha3, my initial examination of them looks good. I'll work on sponsoring them.

For lunar, the fixed version of pypy3 is in lunar-proposed, so I've marked that as fixed committed.

[Launchpad Janitor (janitor)]

This bug was fixed in the package pypy3 - 7.3.11+dfsg-1

---------------
pypy3 (7.3.11+dfsg-1) unstable; urgency=medium

  * New upstream release.
  * Refresh patches.

 -- Stefano Rivera <email address hidden> Fri, 30 Dec 2022 09:29:42 -0400

[Launchpad Janitor (janitor)]

This bug was fixed in the package python3.6 - 3.6.9-1~18.04ubuntu1.10

---------------
python3.6 (3.6.9-1~18.04ubuntu1.10) bionic-security; urgency=medium

  * SECURITY UPDATE: Buffer overflow in SHA3 (Keccak)
    - debian/patches/CVE-2022-37454.patch: fix a buffer overflow in
      Modules/_sha3/kcp/KeccakSponge.inc, Lib/test/test_hashlib.py
     (LP: #1995197).
    - CVE-2022-37454

 -- Dimitri John Ledkov <email address hidden> Tue, 28 Feb 2023 09:55:20 +0000

[Andreas Hasenack (ahasenack)]

pysha3 was removed[1] from lunar:

Deleted on 2022-11-16 by Steve Langasek
(From Debian) RoQA; Backport package now unmaintained upstream; Debian bug #1023033

1. https://launchpad.net/ubuntu/+source/pysha3/+publishinghistory

[Andreas Hasenack (ahasenack)]

kinetic is eol

[Utkarsh Gupta (utkarsh)]

Ubuntu 22.10 (Kinetic Kudu) has reached end of life, so this bug will not be fixed for that specific release.

[Launchpad Janitor (janitor)]

This bug was fixed in the package pypy3 - 7.3.1+dfsg-4ubuntu0.1

---------------
pypy3 (7.3.1+dfsg-4ubuntu0.1) focal-security; urgency=high

  * SECURITY UPDATE: Fix buffer overflow in SHA3 (Keccak) implementation.
  * References: CVE-2022-37454 (LP: #1995197).

 -- Stefano Rivera <email address hidden> Sat, 29 Oct 2022 18:45:41 +0200

[Launchpad Janitor (janitor)]

This bug was fixed in the package pysha3 - 1.0.2-4ubuntu0.1

---------------
pysha3 (1.0.2-4ubuntu0.1) focal-security; urgency=medium

  * SECURITY UPDATE: Fix buffer overflow in SHA3 (Keccak) implementation.
  * References: CVE-2022-37454 (LP: #1995197)

 -- Stefano Rivera <email address hidden> Sun, 30 Oct 2022 12:14:22 +0200

[Launchpad Janitor (janitor)]

This bug was fixed in the package pypy3 - 7.3.9+dfsg-1ubuntu0.1

---------------
pypy3 (7.3.9+dfsg-1ubuntu0.1) jammy-security; urgency=high

  * SECURITY UPDATE: Fix buffer overflow in SHA3 (Keccak) implementation.
  * References: CVE-2022-37454 (LP: #1995197)

 -- Stefano Rivera <email address hidden> Sat, 29 Oct 2022 18:49:55 +0200

[Launchpad Janitor (janitor)]

This bug was fixed in the package pysha3 - 1.0.2-4.2ubuntu0.22.04.1

---------------
pysha3 (1.0.2-4.2ubuntu0.22.04.1) jammy-security; urgency=medium

  * SECURITY UPDATE: Fix buffer overflow in SHA3 (Keccak) implementation.
  * References: CVE-2022-37454 (LP: #1995197)

 -- Stefano Rivera <email address hidden> Sun, 30 Oct 2022 12:14:22 +0200