PyPI/cryptography CVE-2020-36242: unknown, EPSS 6.72%
In the cryptography package before 3.3.2 for Python, certain sequences of update calls to symmetrically encrypt multi-GB values could result in an integer overflow and buffer overflow, as demonstrated
Action: Upgrade cryptography to 3.3.2 or later.
pip install cryptography==3.3.2Affected
| introduced | fixed | last affected |
|---|---|---|
| 3.1 | 3.3.2 | - |
Fixed versions
| 3.3.2 |
Sources
- osv: PYSEC-2021-63
- https://github.com/pyca/cryptography/issues/5615
- https://github.com/pyca/cryptography/blob/master/CHANGELOG.rst
- https://github.com/pyca/cryptography/compare/3.3.1...3.3.2
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L7RGQLK4J5ZQFRLKCHVVG6BKZTUQMG7E/
- https://github.com/advisories/GHSA-rhm9-p9w5-fwm7
CVE-2020-36242 · published · modified · JSON