-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PythonPython| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| pysha3 | pip | <= 1.0.2 | |
| sha3 | rubygems | < 1.0.5 | 1.0.5 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from improper handling of large partial blocks in the sponge functions. The commit fdc6fef0 shows critical fixes in both SpongeAbsorb and SpongeSqueeze where: 1) Partial block size calculations were changed from 'partialBlock = (unsigned int)(dataByteLen - i)' to overflow-safe comparisons, 2) Buffer management logic was modified to prevent integer wrap-around. The GitHub issue #105 explicitly identifies these functions as containing the vulnerable comparison patterns. Multiple implementations (Python's hashlib, PHP's hash_init) using this XKCP code exhibited the crash behavior described, confirming the functions' roles.
Ongoing coverage of React2Shell