[CVE-2022-37454] Buffer overflow in the _sha3 module in python versions <= 3.10 #98517

CVE-2022-37454 affects Python versions prior to 3.11. The fix discussed in XKCP's advisory can be adapted to these versions. The discoverer's writeup contains code that might be turned into regression tests.

Python 3.11 and later switched to using tiny_sha3 in GH-32060, so they should not be affected.

Linked PRs

• [3.10] gh-98517: Fix buffer overflows in _sha3 module #98519
• [3.9] gh-98517: Fix buffer overflows in _sha3 module (GH-98519) #98526
• [3.8] gh-98517: Fix buffer overflows in _sha3 module (GH-98519) #98527
• [3.7] gh-98517: Fix buffer overflows in _sha3 module (GH-98519) #98528