{"id":"CVE-2020-36242","published":"2021-02-07T19:50:57Z","modified":"2024-08-04T17:23:09Z","title":"In the cryptography package before 3.3.2 for Python, certain sequences of update calls to symmetrically encrypt…","vendor":null,"product":null,"tier":"tail","description":{"text":"In the cryptography package before 3.3.2 for Python, certain sequences of update calls to symmetrically encrypt multi-GB values could result in an integer overflow and buffer overflow, as demonstrated by the Fernet class.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.06718,"percentile":0.93919,"provenance":"source"},"cwes":[],"references":[{"url":"https://github.com/pyca/cryptography/issues/5615","tags":["x_refsource_MISC"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L7RGQLK4J5ZQFRLKCHVVG6BKZTUQMG7E/","tags":["vendor-advisory","x_refsource_FEDORA"]},{"url":"https://www.oracle.com/security-alerts/cpuapr2022.html","tags":["x_refsource_MISC"]},{"url":"https://github.com/pyca/cryptography/compare/3.3.1...3.3.2","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/pyca/cryptography/blob/master/CHANGELOG.rst","tags":["x_refsource_CONFIRM"]},{"url":"https://www.oracle.com/security-alerts/cpujul2022.html","tags":["x_refsource_MISC"]}],"priority":{"score":18.8,"factors":[{"name":"EPSS percentile","points":18.78}]},"affected":[{"ecosystem":"PyPI","package":"cryptography","vulnerableRanges":[">=3.1, <3.3.2"],"patched":["3.3.2"],"from":["GHSA-rhm9-p9w5-fwm7","PYSEC-2021-63"],"provenance":"source"}],"euvd":{"id":"EUVD-2021-0048","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-pyca-cryptography-cve-2020-36242","children":[{"from":"CVE-2020-36242","to":"CVE-2023-49083","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["src/cryptography/__about__.py","vectors/cryptography_vectors/__about__.py"],"commits":["https://github.com/pyca/cryptography/commit/82b6ce28389f0a317bc55ba2091a74b346db7cae","https://github.com/pyca/cryptography/commit/f09c261ca10a31fe41b1262306db7f8f1da0e48a"],"basis":"rarely changed file"}]}],"packageHistory":[{"cve":"CVE-2016-9243","published":"2017-03-27","fixed":"1.5.3","kev":false},{"cve":"CVE-2018-10903","published":"2018-07-30","fixed":"2.3","kev":false},{"cve":"CVE-2020-25659","published":"2021-01-11","fixed":"3.2.1","kev":false,"link":{"from":"CVE-2020-25659","to":"CVE-2020-36242","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:cryptography","fromFixed":"3.2.1","toFixed":"3.3.2","daysApart":27}]}},{"cve":"CVE-2020-36242","published":"2021-02-07","fixed":"3.3.2","kev":false},{"cve":"CVE-2023-0286","published":"2023-02-08","fixed":"39.0.1","kev":false},{"cve":"CVE-2023-23931","published":"2023-02-07","fixed":"39.0.1","kev":false},{"cve":"CVE-2023-38325","published":"2023-07-14","fixed":"41.0.2","kev":false}],"package":"PyPI:cryptography"}}