CVE-2022-37454
CriticalAdvisory
Published 21 Oct 2022In the index since 5 Sept 2026
- Severity
- Critical
- worst across findings
- CVSS
- 9.8
- base score, highest
- EPSS
- 0.057
- 93rd percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 193
- of 17,781 indexed, latest versions
- Container images
- 174
- deployed by those charts
- Fix available
- 9 of 10
- affected packages
Buffer overflow in sponge queue functions
Carried by container images the latest versions of 193 of 17,781 indexed charts deploy, on 174 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| python3.8deb | 3.8.5-1~20.04, 3.8.5-1~20.04.2, 3.8.5-1~20.04.3, 3.8.10-0ubuntu1~20.04+4 more | 3.8.10-0ubuntu1~20.04.6 | 62 |
| python3.6deb | 3.6.6-1~18.04, 3.6.7-1~18.04, 3.6.9-1~18.04, 3.6.9-1~18.04ubuntu1+6 more | 3.6.9-1~18.04ubuntu1.10 | 38 |
| python3.10deb | 3.10.4-3, 3.10.4-3ubuntu0.1, 3.10.6-1~22.04, 3.10.6-1~22.04.1 | 3.10.6-1~22.04.2 | 8 |
| python3apk | 3.10.3-r1, 3.10.4-r0, 3.10.5-r0, 3.10.8-r0+1 more | 3.10.9-r0 | 6 |
| php7.4deb | 7.4.3-4ubuntu2.6, 7.4.3-4ubuntu2.12, 7.4.3-4ubuntu2.13 | 7.4.3-4ubuntu2.15 | 3 |
| libphpbitnami | 7.4.33-1 | 7.4.33 | 1 |
| phpbitnami | 7.4.33-2 | 7.4.33 | 1 |
| php8.1deb | 8.1.2-1ubuntu2.3 | 8.1.2-1ubuntu2.8 | 1 |
| pysha3pypi | 1.0.2 | no fix listed | 1 |
| python3.7deb | 3.7.3-2, 3.7.3-2+deb10u1, 3.7.3-2+deb10u2, 3.7.3-2+deb10u3 | 3.7.3-2+deb10u4 | 58 |
- OSV records
- ALPINE-CVE-2022-37454BIT-libphp-2022-37454BIT-php-2022-37454GHSA-6w4m-2xhg-2658UBUNTU-CVE-2022-37454DLA-3175-1
- Also known as
- BIT-libpython-2022-37454, BIT-php-min-2022-37454, BIT-python-2022-37454, BIT-python-min-2022-37454, PSF-2022-11, PYSEC-2026-504, USN-5717-1, USN-5767-1, USN-5767-3
Charts affected
193 by stars
Container images carrying it
174 by charts deploying them
A fixed version is listed for 9 of the 10 affected packages.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| eaudeweb/ | b8ad9b7e19bb | python3.7 | 3.7.3-2+deb10u4 | 1 |
| elastictranscoder/ | b4a0327029e6 | python3.6 | 3.6.9-1~18.04ubuntu1.10 | 1 |
| elastictranscoder/ | 5b75d19e2733 | python3.6 | 3.6.9-1~18.04ubuntu1.10 | 1 |
| esphome/ | 3f51ec10e823 | python3.7 | 3.7.3-2+deb10u4 | 1 |
| frankescobar/ | 8a4d7e9308de | python3.6 | 3.6.9-1~18.04ubuntu1.10 | 1 |
| frankescobar/ | cafa03b94dac | python3.6 | 3.6.9-1~18.04ubuntu1.10 | 1 |
| galaxy/ | e5c265fe9fcd | python3.8 | 3.8.10-0ubuntu1~20.04.6 | 1 |
| geoscienceaustralia/ | f4039b45572a | python3.6 | 3.6.9-1~18.04ubuntu1.10 | 1 |
| gethue/ | 5702b2c37ff9 | python3.6 | 3.6.9-1~18.04ubuntu1.10 | 1 |
| gollumorg/ | 7cd5305a3cf7 | python3.7 | 3.7.3-2+deb10u4 | 1 |
| haugene/ | 059216cfae4b | python3.8 | 3.8.10-0ubuntu1~20.04.6 | 1 |
| haveagitgat/ | 1256348872ce | python3.8 | 3.8.10-0ubuntu1~20.04.6 | 1 |
| haveagitgat/ | 1e3f9328327d | python3.8 | 3.8.10-0ubuntu1~20.04.6 | 1 |
| improwised/ | 97280b55cbd4 | python3.7 | 3.7.3-2+deb10u4 | 1 |
| intel/ | aa8f5483a2ef | python3.8 | 3.8.10-0ubuntu1~20.04.6 | 1 |
| intel/ | 1a89327e499b | python3.8 | 3.8.10-0ubuntu1~20.04.6 | 1 |
| iosifache/ | 85df3f04b5da | python3.8 | 3.8.10-0ubuntu1~20.04.6 | 1 |
| istio/ | 2232f365aed6 | python3.6 | 3.6.9-1~18.04ubuntu1.10 | 1 |
| istio/ | 655eefa11c84 | python3.6 | 3.6.9-1~18.04ubuntu1.10 | 1 |
| istio/ | 294ca55bd1cc | python3.6 | 3.6.9-1~18.04ubuntu1.10 | 1 |
| istio/ | e7e110a421c2 | python3.6 | 3.6.9-1~18.04ubuntu1.10 | 1 |
| istio/ | 87a9db561d2e | python3.6 | 3.6.9-1~18.04ubuntu1.10 | 1 |
| istio/ | 88c6c693e67a | python3.6 | 3.6.9-1~18.04ubuntu1.10 | 1 |
| jakowenko/ | b858bac9e32a | python3.8 | 3.8.10-0ubuntu1~20.04.6 | 1 |
| jedi132000/ | dc2a81e92f23 | python3.8 | 3.8.10-0ubuntu1~20.04.6 | 1 |
| jupyterhub/ | b6b4a1a34bf0 | python3.8 | 3.8.10-0ubuntu1~20.04.6 | 1 |
| jupyterhub/ | e4770285aaf7 | python3.8 | 3.8.10-0ubuntu1~20.04.6 | 1 |
| k8scloudprovider/ | a30c7a2a594a | python3.7 | 3.7.3-2+deb10u4 | 1 |
| kelvinsp/ | cd33e6db2a59 | python3.7 | 3.7.3-2+deb10u4 | 1 |
| kennethreitz/ | 599fe5e50731 | python3.6 | 3.6.9-1~18.04ubuntu1.10 | 1 |
| kubeoperator/ | be8f0d624640 | python3.6 | 3.6.9-1~18.04ubuntu1.10 | 1 |
| library/ | b6dd45cc35b3 | python3.6 | 3.6.9-1~18.04ubuntu1.10 | 1 |
| library/ | c3e526769bfd | python3 | 3.10.9-r0 | 1 |
| linuxserver/ | a847b5b2d860 | python3.6 | 3.6.9-1~18.04ubuntu1.10 | 1 |
| linuxserver/ | 938810eca3d3 | python3.8 | 3.8.10-0ubuntu1~20.04.6 | 1 |
| linuxserver/ | 0ac871624394 | python3.6 | 3.6.9-1~18.04ubuntu1.10 | 1 |
| linuxserver/ | 2ce561a95e7b | python3.6 | 3.6.9-1~18.04ubuntu1.10 | 1 |
| linuxserver/ | f93d2560e233 | python3.6 | 3.6.9-1~18.04ubuntu1.10 | 1 |
| longhornio/ | dca34321452c | python3.8 | 3.8.10-0ubuntu1~20.04.6 | 1 |
| longhornio/ | ede61fe2a472 | python3.6 | 3.6.9-1~18.04ubuntu1.10 | 1 |
| louislam/ | a4eab252e5a2 | python3.7 | 3.7.3-2+deb10u4 | 1 |
| louislam/ | a84767d7934f | python3.7 | 3.7.3-2+deb10u4 | 1 |
| lsstdm/ | 973df082d006 | python3.7 | 3.7.3-2+deb10u4 | 1 |
| lsstdm/ | 74c97a490940 | python3.7 | 3.7.3-2+deb10u4 | 1 |
| lsstsqre/ | be1b21060854 | python3.7 | 3.7.3-2+deb10u4 | 1 |
| lsstsqre/ | b75bf8aaafa4 | python3.8 | 3.8.10-0ubuntu1~20.04.6 | 1 |
| lsstsqre/ | 4879415ec6ac | python3.7 | 3.7.3-2+deb10u4 | 1 |
| matrixdb/ | 95b2e38e913d | python3 | 3.10.9-r0 | 1 |
| mediagis/ | c15e941485ef | php7.4 python3.8 | 7.4.3-4ubuntu2.15 3.8.10-0ubuntu1~20.04.6 | 1 |
| miltex/ | dab12a7748d5 | python3.7 | 3.7.3-2+deb10u4 | 1 |