CVE-2022-37454
CriticalAdvisory
Published 21 Oct 2022In the index since 5 Sept 2026
- Severity
- Critical
- worst across findings
- CVSS
- 9.8
- base score, highest
- EPSS
- 0.057
- 93rd percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 193
- of 17,781 indexed, latest versions
- Container images
- 174
- deployed by those charts
- Fix available
- 9 of 10
- affected packages
Buffer overflow in sponge queue functions
Carried by container images the latest versions of 193 of 17,781 indexed charts deploy, on 174 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| python3.8deb | 3.8.5-1~20.04, 3.8.5-1~20.04.2, 3.8.5-1~20.04.3, 3.8.10-0ubuntu1~20.04+4 more | 3.8.10-0ubuntu1~20.04.6 | 62 |
| python3.6deb | 3.6.6-1~18.04, 3.6.7-1~18.04, 3.6.9-1~18.04, 3.6.9-1~18.04ubuntu1+6 more | 3.6.9-1~18.04ubuntu1.10 | 38 |
| python3.10deb | 3.10.4-3, 3.10.4-3ubuntu0.1, 3.10.6-1~22.04, 3.10.6-1~22.04.1 | 3.10.6-1~22.04.2 | 8 |
| python3apk | 3.10.3-r1, 3.10.4-r0, 3.10.5-r0, 3.10.8-r0+1 more | 3.10.9-r0 | 6 |
| php7.4deb | 7.4.3-4ubuntu2.6, 7.4.3-4ubuntu2.12, 7.4.3-4ubuntu2.13 | 7.4.3-4ubuntu2.15 | 3 |
| libphpbitnami | 7.4.33-1 | 7.4.33 | 1 |
| phpbitnami | 7.4.33-2 | 7.4.33 | 1 |
| php8.1deb | 8.1.2-1ubuntu2.3 | 8.1.2-1ubuntu2.8 | 1 |
| pysha3pypi | 1.0.2 | no fix listed | 1 |
| python3.7deb | 3.7.3-2, 3.7.3-2+deb10u1, 3.7.3-2+deb10u2, 3.7.3-2+deb10u3 | 3.7.3-2+deb10u4 | 58 |
- OSV records
- ALPINE-CVE-2022-37454BIT-libphp-2022-37454BIT-php-2022-37454GHSA-6w4m-2xhg-2658UBUNTU-CVE-2022-37454DLA-3175-1
- Also known as
- BIT-libpython-2022-37454, BIT-php-min-2022-37454, BIT-python-2022-37454, BIT-python-min-2022-37454, PSF-2022-11, PYSEC-2026-504, USN-5717-1, USN-5767-1, USN-5767-3
Charts affected
193 by stars
Container images carrying it
174 by charts deploying them
A fixed version is listed for 9 of the 10 affected packages.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| mozilla/ | 1da6ff5c4895 | python3.7 | 3.7.3-2+deb10u4 | 1 |
| netboxcommunity/ | 3d652dca5351 | python3.10 | 3.10.6-1~22.04.2 | 1 |
| omecproject/ | bcc5f19fd676 | python3.6 | 3.6.9-1~18.04ubuntu1.10 | 1 |
| opendatacube/ | 5d810e8504b8 | python3.6 | 3.6.9-1~18.04ubuntu1.10 | 1 |
| opendatacube/ | 91870111837c | python3.6 | 3.6.9-1~18.04ubuntu1.10 | 1 |
| opendatacube/ | 1b90cdf68831 | python3.6 | 3.6.9-1~18.04ubuntu1.10 | 1 |
| openelevation/ | 82fb21612e86 | python3.8 | 3.8.10-0ubuntu1~20.04.6 | 1 |
| openkm/ | 3bc465a7461b | python3.8 | 3.8.10-0ubuntu1~20.04.6 | 1 |
| openproject/ | 734743d11094 | python3.7 | 3.7.3-2+deb10u4 | 1 |
| openwhisk/ | 63dc3d2a0904 | python3.7 | 3.7.3-2+deb10u4 | 1 |
| oxheadalpha/ | d9faed45bf1c | pysha3 | no fix listed | 1 |
| pecan/ | 73b2074f3fec | python3.7 | 3.7.3-2+deb10u4 | 1 |
| phntom/ | 49b6488f618b | python3 | 3.10.9-r0 | 1 |
| plumdog/ | 0c2fa2db0357 | python3.7 | 3.7.3-2+deb10u4 | 1 |
| project2team4/ | 3ff031a08887 | python3.8 | 3.8.10-0ubuntu1~20.04.6 | 1 |
| puppet/ | 0b6fd9a6b7da | python3.6 | 3.6.9-1~18.04ubuntu1.10 | 1 |
| rlex/ | cd50ff65118e | python3.7 | 3.7.3-2+deb10u4 | 1 |
| roadiehq/ | ef355bf5b639 | python3.7 | 3.7.3-2+deb10u4 | 1 |
| samajh/ | ea742b4372ad | python3.7 | 3.7.3-2+deb10u4 | 1 |
| samajh/ | 05ef4fddbb75 | python3.7 | 3.7.3-2+deb10u4 | 1 |
| scrapinghub/ | a5f89bc84606 | python3.6 | 3.6.9-1~18.04ubuntu1.10 | 1 |
| seafileltd/ | 6693911bcc40 | python3.8 | 3.8.10-0ubuntu1~20.04.6 | 1 |
| seafileltd/ | 7ac833196f60 | python3.8 | 3.8.10-0ubuntu1~20.04.6 | 1 |
| seafileltd/ | ed0fcda5e6a9 | python3.8 | 3.8.10-0ubuntu1~20.04.6 | 1 |
| shinobisystems/ | 3ca746937856 | python3.7 | 3.7.3-2+deb10u4 | 1 |
| shinobisystems/ | c2f5ce2e1067 | python3.7 | 3.7.3-2+deb10u4 | 1 |
| sismics/ | f4b0ef019cf1 | python3.6 | 3.6.9-1~18.04ubuntu1.10 | 1 |
| snipe/ | 55fb7636a98c | php7.4 python3.8 | 7.4.3-4ubuntu2.15 3.8.10-0ubuntu1~20.04.6 | 1 |
| someblackmagic/ | 6eca64b6b440 | python3.8 | 3.8.10-0ubuntu1~20.04.6 | 1 |
| stanfordoval/ | 1a63cdccedaf | python3.7 | 3.7.3-2+deb10u4 | 1 |
| stashapp/ | 24dbd7607174 | python3.8 | 3.8.10-0ubuntu1~20.04.6 | 1 |
| statcan/ | 3921305425b8 | python3.8 | 3.8.10-0ubuntu1~20.04.6 | 1 |
| streamnative/ | 11bceacec8fb | python3.8 | 3.8.10-0ubuntu1~20.04.6 | 1 |
| tdeutsch/ | b67186f4c9a5 | python3 | 3.10.9-r0 | 1 |
| timescale/ | ed719c0cd19d | python3.10 | 3.10.6-1~22.04.2 | 1 |
| tooljet/ | c85a4720e42e | python3.7 | 3.7.3-2+deb10u4 | 1 |
| vinanrra/ | f9534490bd2b | python3.6 | 3.6.9-1~18.04ubuntu1.10 | 1 |
| weblate/ | 82848df56ecd | python3.7 | 3.7.3-2+deb10u4 | 1 |
| wiremind/ | 4dea42c8166c | python3.7 | 3.7.3-2+deb10u4 | 1 |
| xeladock/ | 4baf531453f1 | python3.10 | 3.10.6-1~22.04.2 | 1 |
| zabbix/ | 01de79c31391 | php7.4 python3.8 | 7.4.3-4ubuntu2.15 3.8.10-0ubuntu1~20.04.6 | 1 |
| zabbix/ | 99e9a090b516 | php8.1 python3.10 | 8.1.2-1ubuntu2.8 3.10.6-1~22.04.2 | 1 |
| zohardocker12/ | b86d60dbb68d | python3.7 | 3.7.3-2+deb10u4 | 1 |
| ghcr.io/ | bcd5b8d4c45c | python3.6 | 3.6.9-1~18.04ubuntu1.10 | 1 |
| ghcr.io/ | d6e901ad0ebd | python3.7 | 3.7.3-2+deb10u4 | 1 |
| ghcr.io/ | 3fbe4c29d14c | python3.8 | 3.8.10-0ubuntu1~20.04.6 | 1 |
| ghcr.io/ | 6047599cd78e | python3.8 | 3.8.10-0ubuntu1~20.04.6 | 1 |
| ghcr.io/ | fdb5501cdfb9 | python3.8 | 3.8.10-0ubuntu1~20.04.6 | 1 |
| ghcr.io/ | 827aa2f2389d | python3.8 | 3.8.10-0ubuntu1~20.04.6 | 1 |
| ghcr.io/ | e5571acd10ce | python3.10 | 3.10.6-1~22.04.2 | 1 |