kritisch

CVE-2020-36242

python-cryptography: Large inputs for symmetric encryption can trigger integer overflow leading to buffer overflow

Veröffentlicht 7. Feb. 2021Geändert 17. Juni 2026CWE 190, 787

In der Trivy Database seit spätestens 24. Okt. 2026, 07:11 UTCWann der Eintrag vor diesem Build hinzukam, ist nicht erfasst.

Einstufung nach Quelle

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

GHSA8.8CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N

Red Hat8.2CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

Trivys eigenes Label ist CRITICAL. Kritisch laut NVD, CBL-Mariner, Photon OS. Niedriger laut GHSA (hoch), Red Hat (mittel), Oracle (mittel), Rocky Linux (mittel).

Beschreibung

In the cryptography package before 3.3.2 for Python, certain sequences of update calls to symmetrically encrypt multi-GB values could result in an integer overflow and buffer overflow, as demonstrated by the Fernet class.

Betroffene Pakete und behobene Versionen

Quelle	Paket	Behoben in
CBL-Mariner 1.0	python-cryptography	0:3.3.2-1.cm1
Photon OS 1.0	python-cryptography	1.9-1.ph1
Photon OS 2.0	python-cryptography	2.3.1-2.ph2
Photon OS 3.0	python-cryptography	2.8-2.ph3
Photon OS 4.0	python3-cryptography	3.3.2-1.ph4
alpine 3.13	py3-cryptography	3.3.2-r0
alpine 3.16	py3-cryptography	3.2.2-r0
alpine 3.17	py3-cryptography	3.2.2-r0
alpine 3.18	py3-cryptography	3.2.2-r0
alpine 3.19	py3-cryptography	3.2.2-r0
alpine 3.20	py3-cryptography	3.2.2-r0
alpine 3.21	py3-cryptography	3.2.2-r0

Alle 32 Einträge aus 27 Quellen zeigen

Quelle	Paket	Behoben in
CBL-Mariner 1.0	python-cryptography	0:3.3.2-1.cm1
Photon OS 1.0	python-cryptography	1.9-1.ph1
Photon OS 2.0	python-cryptography	2.3.1-2.ph2
Photon OS 3.0	python-cryptography	2.8-2.ph3
Photon OS 4.0	python3-cryptography	3.3.2-1.ph4
alpine 3.13	py3-cryptography	3.3.2-r0
alpine 3.16	py3-cryptography	3.2.2-r0
alpine 3.17	py3-cryptography	3.2.2-r0
alpine 3.18	py3-cryptography	3.2.2-r0
alpine 3.19	py3-cryptography	3.2.2-r0
alpine 3.20	py3-cryptography	3.2.2-r0
alpine 3.21	py3-cryptography	3.2.2-r0
alpine 3.22	py3-cryptography	3.2.2-r0
alpine 3.23	py3-cryptography	3.2.2-r0
alpine 3.24	py3-cryptography	3.2.2-r0
alpine edge	py3-cryptography	3.2.2-r0
debian 10	python-cryptography	kein Fix angegeben
debian 11	python-cryptography	3.3.2-1
debian 12	python-cryptography	3.3.2-1
debian 13	python-cryptography	3.3.2-1
debian 14	python-cryptography	3.3.2-1
echo	python-cryptography	3.3.2-1
Oracle Linux 8	python3-cryptography	3.2.1-4.el8
pip::GitHub Security Advisory pip	cryptography	3.3.2
Red Hat	python-cryptography	kein Fix angegeben
Red Hat	python2-cryptography	kein Fix angegeben
Red Hat	python38:3.8::python-cryptography	kein Fix angegeben
Red Hat	python38:3.8::python3-cryptography	kein Fix angegeben
Red Hat	python39:3.9::python-cryptography	kein Fix angegeben
Red Hat	python39:3.9::python3-cryptography	kein Fix angegeben
rocky 8	python3-cryptography	3.2.1-4.el8
root.io debian 12	rootio-python-cryptography	3.3.2-1

Referenzen

Alle 29 Referenzen