CVE-2020-36242
Severity
9.1CRITICAL
EPSS
1.6%
top 18.46%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedFeb 7
Latest updateJan 15
Description
In the cryptography package before 3.3.2 for Python, certain sequences of update calls to symmetrically encrypt multi-GB values could result in an integer overflow and buffer overflow, as demonstrated by the Fernet class.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:HExploitability: 3.9 | Impact: 5.2
Affected Packages4 packages
Also affects: Fedora 33
Patches
🔴Vulnerability Details
4GHSA
▶
📋Vendor Advisories
5Oracle
▶
Oracle
▶
Microsoft▶
In the cryptography package before 3.3.2 for Python certain sequences of update calls to symmetrically encrypt multi-GB values could result in an integer overflow and buffer overflow as demonstrated b↗2021-02-09
Red Hat▶
python-cryptography: Large inputs for symmetric encryption can trigger integer overflow leading to buffer overflow↗2020-12-09
Debian▶
CVE-2020-36242: python-cryptography - In the cryptography package before 3.3.2 for Python, certain sequences of update...↗2020