Bug 2141754 - CVE-2022-37454 python34: XKCP: buffer overflow in the SHA-3 reference implementation [epel-all]
Summary: CVE-2022-37454 python34: XKCP: buffer overflow in the SHA-3 reference impleme...
Keywords:
Status: CLOSED NOTABUG
Alias: None
Product: Fedora EPEL
Classification: Fedora
Component: python34
Version: epel7
Hardware: Unspecified
OS: Unspecified
high
high
Target Milestone: ---
Assignee: Petr Viktorin (pviktori)
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks: CVE-2022-37454
TreeView+ depends on / blocked
 
Reported: 2022-11-10 17:36 UTC by Guilherme de Almeida Suckevicz
Modified: 2022-11-14 17:39 UTC (History)
6 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2022-11-10 18:06:49 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)

Description Guilherme de Almeida Suckevicz 2022-11-10 17:36:22 UTC
More information about this security flaw is available in the following bug:

http://bugzilla.redhat.com/show_bug.cgi?id=2140200

Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

Comment 1 Guilherme de Almeida Suckevicz 2022-11-10 17:36:25 UTC
Use the following template to for the 'fedpkg update' request to submit an
update for this issue as it contains the top-level parent bug(s) as well as
this tracking bug.  This will ensure that all associated bugs get updated
when new packages are pushed to stable.

=====

# bugfix, security, enhancement, newpackage (required)
type=security

# low, medium, high, urgent (required)
severity=medium

# testing, stable
request=testing

# Bug numbers: 1234,9876
bugs=2140200,2141754

# Description of your update
notes=Security fix for [PUT CVEs HERE]

# Enable request automation based on the stable/unstable karma thresholds
autokarma=True
stable_karma=3
unstable_karma=-3

# Automatically close bugs when this marked as stable
close_bugs=True

# Suggest that users restart after update
suggest_reboot=False

======

Additionally, you may opt to use the bodhi web interface to submit updates:

https://bodhi.fedoraproject.org/updates/new

Comment 2 Miro Hrončok 2022-11-10 18:06:49 UTC
We don't fix medium severity CVEs in RHEL 7 this late in the release cycle, so no fix in EPEL 7 either, unless somebody contributes it.

Comment 3 Miro Hrončok 2022-11-14 17:35:35 UTC
OK then, this just got serious :)


Let me try reproducing it first:


$ mock -r epel-7-x86_64 init
...
$ mock -r epel-7-x86_64 install python34
...
Installed:
  python34.x86_64 0:3.4.10-8.el7                                                                                                                                                                                                 

Dependency Installed:
  python34-libs.x86_64 0:3.4.10-8.el7
...
$ mock -r epel-7-x86_64 shell --unpriv
...
<mock-chroot> sh-4.2$ python3.4
Python 3.4.10 (default, Jun 23 2021, 22:06:51) 
[GCC 4.8.5 20150623 (Red Hat 4.8.5-44)] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> import hashlib
>>> h = hashlib.sha3_224()
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
AttributeError: 'module' object has no attribute 'sha3_224'


Seems like there is no such thing in here. 


https://docs.python.org/3.6/whatsnew/3.6.html says "The hashlib module received support for the BLAKE2, SHA-3 and SHAKE hash algorithms and the scrypt() key derivation function."

[fedora-scm]$ fedpkg clone python34
Cloning into 'python34'...
[fedora-scm]$ cd python34
[python34 (rawhide)]$ git switch epel7 
branch 'epel7' set up to track 'origin/epel7'.
Switched to a new branch 'epel7'
[python34 (epel7)]$ fedpkg --release rawhide prep
...
[python34 (epel7 %)]$ cd Python-3.4.10/
[Python-3.4.10 (epel7 %)]$ rg -F 'rateInBytes'
[Python-3.4.10 (epel7 %)]$ echo $?
1


Hence, Python 3.4 is not affected.

Comment 4 Guilherme de Almeida Suckevicz 2022-11-14 17:39:35 UTC
Thank you for checking this Miro! :)


Note You need to log in before you can comment on or make changes to this bug.