CVSS 3.1
9.1 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:HCVE-2020-36242
Critical (9.1). EPSS 6.7% chance of exploitation in the next 30 days. Fixed in cryptography 3.3.2.
In the cryptography package before 3.3.2 for Python, certain sequences of update calls to symmetrically encrypt multi-GB values could result in an integer overflow and buffer overflow, as demonstrated by the Fernet class.
Severity
- EPSS
- 6.7% chance of exploitation in the next 30 days; higher than 93% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-190, CWE-787
- Published
- Modified
- Record from
- the NVD, synced
Affected
- cryptography.io:cryptography
- fedoraproject:fedora
- oracle:communications_cloud_native_core_network_function_cloud_native_environment
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-rhm9-p9w5-fwm7 | PyPI | cryptography | >=3.1 <3.3.2 | 3.3.2 |
| PYSEC-2021-63 | PyPI | cryptography | >=3.1 <3.3.2 | 3.3.2 |
References
- https://github.com/pyca/cryptography/blob/master/CHANGELOG.rst
- https://github.com/pyca/cryptography/compare/3.3.1...3.3.2
- https://github.com/pyca/cryptography/issues/5615
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L7RGQLK4J5ZQFRLKCHVVG6BKZTUQMG7E/
- https://www.oracle.com/security-alerts/cpuapr2022.html