crítica

CVE-2020-36242

python-cryptography: Large inputs for symmetric encryption can trigger integer overflow leading to buffer overflow

Publicada 7 feb 2021Modificada 17 jun 2026CWE 190, 787

En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.

Severidad por fuente

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

GHSA8.8CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N

Red Hat8.2CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

La etiqueta propia de Trivy es CRITICAL. Crítica según NVD, CBL-Mariner, Photon OS. Más baja según GHSA (alta), Red Hat (media), Oracle (media), Rocky Linux (media).

Descripción

In the cryptography package before 3.3.2 for Python, certain sequences of update calls to symmetrically encrypt multi-GB values could result in an integer overflow and buffer overflow, as demonstrated by the Fernet class.

Paquetes afectados y versiones corregidas

Fuente	Paquete	Corregido en
CBL-Mariner 1.0	python-cryptography	0:3.3.2-1.cm1
Photon OS 1.0	python-cryptography	1.9-1.ph1
Photon OS 2.0	python-cryptography	2.3.1-2.ph2
Photon OS 3.0	python-cryptography	2.8-2.ph3
Photon OS 4.0	python3-cryptography	3.3.2-1.ph4
alpine 3.13	py3-cryptography	3.3.2-r0
alpine 3.16	py3-cryptography	3.2.2-r0
alpine 3.17	py3-cryptography	3.2.2-r0
alpine 3.18	py3-cryptography	3.2.2-r0
alpine 3.19	py3-cryptography	3.2.2-r0
alpine 3.20	py3-cryptography	3.2.2-r0
alpine 3.21	py3-cryptography	3.2.2-r0

Mostrar las 32 entradas de 27 fuentes

Fuente	Paquete	Corregido en
CBL-Mariner 1.0	python-cryptography	0:3.3.2-1.cm1
Photon OS 1.0	python-cryptography	1.9-1.ph1
Photon OS 2.0	python-cryptography	2.3.1-2.ph2
Photon OS 3.0	python-cryptography	2.8-2.ph3
Photon OS 4.0	python3-cryptography	3.3.2-1.ph4
alpine 3.13	py3-cryptography	3.3.2-r0
alpine 3.16	py3-cryptography	3.2.2-r0
alpine 3.17	py3-cryptography	3.2.2-r0
alpine 3.18	py3-cryptography	3.2.2-r0
alpine 3.19	py3-cryptography	3.2.2-r0
alpine 3.20	py3-cryptography	3.2.2-r0
alpine 3.21	py3-cryptography	3.2.2-r0
alpine 3.22	py3-cryptography	3.2.2-r0
alpine 3.23	py3-cryptography	3.2.2-r0
alpine 3.24	py3-cryptography	3.2.2-r0
alpine edge	py3-cryptography	3.2.2-r0
debian 10	python-cryptography	sin corrección indicada
debian 11	python-cryptography	3.3.2-1
debian 12	python-cryptography	3.3.2-1
debian 13	python-cryptography	3.3.2-1
debian 14	python-cryptography	3.3.2-1
echo	python-cryptography	3.3.2-1
Oracle Linux 8	python3-cryptography	3.2.1-4.el8
pip::GitHub Security Advisory pip	cryptography	3.3.2
Red Hat	python-cryptography	sin corrección indicada
Red Hat	python2-cryptography	sin corrección indicada
Red Hat	python38:3.8::python-cryptography	sin corrección indicada
Red Hat	python38:3.8::python3-cryptography	sin corrección indicada
Red Hat	python39:3.9::python-cryptography	sin corrección indicada
Red Hat	python39:3.9::python3-cryptography	sin corrección indicada
rocky 8	python3-cryptography	3.2.1-4.el8
root.io debian 12	rootio-python-cryptography	3.3.2-1

Referencias

Las 29 referencias