{"action":"Upgrade cryptography to 3.3.2 or later.","affected":[{"fixed":"3.3.2","introduced":"3.1"}],"component":"cryptography","cve_ids":["CVE-2020-36242"],"ecosystem":"PyPI","epss":0.06718,"exploited":false,"fixed_versions":["3.3.2"],"ghsa_id":"GHSA-rhm9-p9w5-fwm7","id":"tcs_01M5KGE9P7HMVEQ8T5A09FBPB3","modified_at":"2023-11-08T04:03:42.949464Z","published_at":"2021-02-07T20:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2021-63","https://github.com/pyca/cryptography/issues/5615","https://github.com/pyca/cryptography/blob/master/CHANGELOG.rst","https://github.com/pyca/cryptography/compare/3.3.1...3.3.2","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L7RGQLK4J5ZQFRLKCHVVG6BKZTUQMG7E/","https://github.com/advisories/GHSA-rhm9-p9w5-fwm7"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2021-63","url":"https://osv.dev/vulnerability/PYSEC-2021-63"}],"summary":"In the cryptography package before 3.3.2 for Python, certain sequences of update calls to symmetrically encrypt multi-GB values could result in an integer overflow and buffer overflow, as demonstrated"}