In the cryptography package before 3.3.2 for Python, certain sequences of update calls to symmetrically encrypt multi-GB values could result in an integer overflow and buffer overflow, as demonstrated by the Fernet class.
References
Configurations
History
21 Nov 2024, 05:29
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/pyca/cryptography/blob/master/CHANGELOG.rst - Release Notes, Third Party Advisory | |
| References | () https://github.com/pyca/cryptography/compare/3.3.1...3.3.2 - Patch, Third Party Advisory | |
| References | () https://github.com/pyca/cryptography/issues/5615 - Exploit, Patch, Third Party Advisory | |
| References | () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L7RGQLK4J5ZQFRLKCHVVG6BKZTUQMG7E/ - | |
| References | () https://www.oracle.com/security-alerts/cpuapr2022.html - Patch, Third Party Advisory | |
| References | () https://www.oracle.com/security-alerts/cpujul2022.html - Patch, Third Party Advisory |
05 Sep 2024, 16:09
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:cryptography.io:cryptography:*:*:*:*:*:python:*:* | |
| First Time |
Cryptography.io cryptography
Cryptography.io |
07 Nov 2023, 03:22
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
|
Information
Published : 2021-02-07 20:15
Updated : 2024-11-21 05:29
NVD link : CVE-2020-36242
Mitre link : CVE-2020-36242
CVE.ORG link : CVE-2020-36242
JSON object : View
Products Affected
cryptography.io
- cryptography
oracle
- communications_cloud_native_core_network_function_cloud_native_environment
fedoraproject
- fedora