CVE-2022-37454
CriticalAdvisory
Published 21 Oct 2022In the index since 5 Sept 2026
- Severity
- Critical
- worst across findings
- CVSS
- 9.8
- base score, highest
- EPSS
- 0.057
- 93rd percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 193
- of 17,781 indexed, latest versions
- Container images
- 174
- deployed by those charts
- Fix available
- 9 of 10
- affected packages
Buffer overflow in sponge queue functions
Carried by container images the latest versions of 193 of 17,781 indexed charts deploy, on 174 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| python3.8deb | 3.8.5-1~20.04, 3.8.5-1~20.04.2, 3.8.5-1~20.04.3, 3.8.10-0ubuntu1~20.04+4 more | 3.8.10-0ubuntu1~20.04.6 | 62 |
| python3.6deb | 3.6.6-1~18.04, 3.6.7-1~18.04, 3.6.9-1~18.04, 3.6.9-1~18.04ubuntu1+6 more | 3.6.9-1~18.04ubuntu1.10 | 38 |
| python3.10deb | 3.10.4-3, 3.10.4-3ubuntu0.1, 3.10.6-1~22.04, 3.10.6-1~22.04.1 | 3.10.6-1~22.04.2 | 8 |
| python3apk | 3.10.3-r1, 3.10.4-r0, 3.10.5-r0, 3.10.8-r0+1 more | 3.10.9-r0 | 6 |
| php7.4deb | 7.4.3-4ubuntu2.6, 7.4.3-4ubuntu2.12, 7.4.3-4ubuntu2.13 | 7.4.3-4ubuntu2.15 | 3 |
| libphpbitnami | 7.4.33-1 | 7.4.33 | 1 |
| phpbitnami | 7.4.33-2 | 7.4.33 | 1 |
| php8.1deb | 8.1.2-1ubuntu2.3 | 8.1.2-1ubuntu2.8 | 1 |
| pysha3pypi | 1.0.2 | no fix listed | 1 |
| python3.7deb | 3.7.3-2, 3.7.3-2+deb10u1, 3.7.3-2+deb10u2, 3.7.3-2+deb10u3 | 3.7.3-2+deb10u4 | 58 |
- OSV records
- ALPINE-CVE-2022-37454BIT-libphp-2022-37454BIT-php-2022-37454GHSA-6w4m-2xhg-2658UBUNTU-CVE-2022-37454DLA-3175-1
- Also known as
- BIT-libpython-2022-37454, BIT-php-min-2022-37454, BIT-python-2022-37454, BIT-python-min-2022-37454, PSF-2022-11, PYSEC-2026-504, USN-5717-1, USN-5767-1, USN-5767-3
Charts affected
193 by stars
Container images carrying it
174 by charts deploying them
A fixed version is listed for 9 of the 10 affected packages.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| osixia/ | 18742e9c449c | python3.7 | 3.7.3-2+deb10u4 | 7 |
| osixia/ | d112b82be133 | python3.7 | 3.7.3-2+deb10u4 | 5 |
| argoproj/ | 830e86cacefd | python3.7 | 3.7.3-2+deb10u4 | 3 |
| cloudve/ | 4a3d7fae90bb | python3.8 | 3.8.10-0ubuntu1~20.04.6 | 3 |
| dgraph/ | 3b55ea83fffe | python3.8 | 3.8.10-0ubuntu1~20.04.6 | 3 |
| selenium/ | 02f251d48d5f | python3.8 | 3.8.10-0ubuntu1~20.04.6 | 3 |
| amancevice/ | 12a0a9e66550 | python3.7 | 3.7.3-2+deb10u4 | 2 |
| hookiesolutions/ | 0629694246ba | python3.8 | 3.8.10-0ubuntu1~20.04.6 | 2 |
| istio/ | dbb7726d1bf0 | python3.6 | 3.6.9-1~18.04ubuntu1.10 | 2 |
| istio/ | a78b7a165744 | python3.6 | 3.6.9-1~18.04ubuntu1.10 | 2 |
| martinaif/ | 43bc40a3da0e | python3.7 | 3.7.3-2+deb10u4 | 2 |
| osixia/ | ccd95cc6e61e | python3.7 | 3.7.3-2+deb10u4 | 2 |
| smartedge/ | 4cd63c22ce36 | python3.8 | 3.8.10-0ubuntu1~20.04.6 | 2 |
| stakater/ | 3f4926eedc74 | python3.7 | 3.7.3-2+deb10u4 | 2 |
| svtechnmaa/ | b2987abe57d3 | python3.10 | 3.10.6-1~22.04.2 | 2 |
| weblate/ | 69c160d37a3c | python3.7 | 3.7.3-2+deb10u4 | 2 |
| yzhou442/ | a3f7ca69e28d | libphp php | 7.4.33 7.4.33 | 2 |
| ghcr.io/ | 5be52524664c | python3.10 | 3.10.6-1~22.04.2 | 2 |
| ghcr.io/ | 103fbcec2314 | python3.8 | 3.8.10-0ubuntu1~20.04.6 | 2 |
| a10networks/ | 8dc58d434d71 | python3.6 | 3.6.9-1~18.04ubuntu1.10 | 1 |
| adwerx/ | 840d2b078682 | python3.8 | 3.8.10-0ubuntu1~20.04.6 | 1 |
| afrank/ | d463c37b08d7 | python3.7 | 3.7.3-2+deb10u4 | 1 |
| airsonicadvanced/ | f7cbafac2806 | python3.8 | 3.8.10-0ubuntu1~20.04.6 | 1 |
| alerta/ | 4786b9eaa606 | python3.7 | 3.7.3-2+deb10u4 | 1 |
| allegroai/ | 772827a01bb5 | python3.6 | 3.6.9-1~18.04ubuntu1.10 | 1 |
| apachepulsar/ | 3b262ab7a7d9 | python3.8 | 3.8.10-0ubuntu1~20.04.6 | 1 |
| apachepulsar/ | 4db6ff0b4045 | python3.7 | 3.7.3-2+deb10u4 | 1 |
| apachepulsar/ | d056c89b7131 | python3.8 | 3.8.10-0ubuntu1~20.04.6 | 1 |
| apachepulsar/ | d538416d5afe | python3.8 | 3.8.10-0ubuntu1~20.04.6 | 1 |
| arturisimo/ | d8dc4430531e | python3.7 | 3.7.3-2+deb10u4 | 1 |
| asdkant/ | a23d8bf7c885 | python3.7 | 3.7.3-2+deb10u4 | 1 |
| atlassian/ | 3b9222ab32ef | python3.10 | 3.10.6-1~22.04.2 | 1 |
| bastilimbach/ | 41b0835ab31e | python3.7 | 3.7.3-2+deb10u4 | 1 |
| bbernhard/ | 549ad08d7e14 | python3.8 | 3.8.10-0ubuntu1~20.04.6 | 1 |
| bicarus/ | dab88659ae3b | python3.7 | 3.7.3-2+deb10u4 | 1 |
| blakeblackshear/ | ae269270ad9e | python3.8 | 3.8.10-0ubuntu1~20.04.6 | 1 |
| browserless/ | c81ae5585b47 | python3.8 | 3.8.10-0ubuntu1~20.04.6 | 1 |
| camptocamp/ | acfafc308d88 | python3.7 | 3.7.3-2+deb10u4 | 1 |
| camptocamp/ | 35c91d5fda04 | python3.7 | 3.7.3-2+deb10u4 | 1 |
| cdignam/ | 5a6a55b39cee | python3.7 | 3.7.3-2+deb10u4 | 1 |
| ceticasbl/ | 6c0aa7567145 | python3.7 | 3.7.3-2+deb10u4 | 1 |
| chetangautamm/ | e7f7049e1544 | python3.8 | 3.8.10-0ubuntu1~20.04.6 | 1 |
| cloudve/ | af56e77ca587 | python3.6 | 3.6.9-1~18.04ubuntu1.10 | 1 |
| cloudve/ | d79c1c5881c0 | python3.6 | 3.6.9-1~18.04ubuntu1.10 | 1 |
| coderaiser/ | b34a9775c7ce | python3.7 | 3.7.3-2+deb10u4 | 1 |
| codercom/ | 47605610ad8d | python3.7 | 3.7.3-2+deb10u4 | 1 |
| countly/ | e3c238248f99 | python3.8 | 3.8.10-0ubuntu1~20.04.6 | 1 |
| daskdev/ | 052630f5ca04 | python3.6 | 3.6.9-1~18.04ubuntu1.10 | 1 |
| davidvmar/ | e9ce2608f799 | python3 | 3.10.9-r0 | 1 |
| dnationcloud/ | dee6376560f5 | python3.7 | 3.7.3-2+deb10u4 | 1 |