kritik

CVE-2020-36242

python-cryptography: Large inputs for symmetric encryption can trigger integer overflow leading to buffer overflow

Yayın 7 Şub 2021Değişiklik 17 Haz 2026CWE 190, 787

En geç 24 Eki 2026, 07:11 UTC tarihinden beri Trivy database'indeO derlemeden önce ne zaman girdiği kayıtlı değil.

Kaynağa göre önem derecesi

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

GHSA8.8CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N

Red Hat8.2CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

Trivy'nin kendi etiketi CRITICAL. Kritik diyenler: NVD, CBL-Mariner, Photon OS. Daha düşük diyenler: GHSA (yüksek), Red Hat (orta), Oracle (orta), Rocky Linux (orta).

Açıklama

In the cryptography package before 3.3.2 for Python, certain sequences of update calls to symmetrically encrypt multi-GB values could result in an integer overflow and buffer overflow, as demonstrated by the Fernet class.

Etkilenen paketler ve düzeltilmiş sürümler

Kaynak	Paket	Düzeltildiği sürüm
CBL-Mariner 1.0	python-cryptography	0:3.3.2-1.cm1
Photon OS 1.0	python-cryptography	1.9-1.ph1
Photon OS 2.0	python-cryptography	2.3.1-2.ph2
Photon OS 3.0	python-cryptography	2.8-2.ph3
Photon OS 4.0	python3-cryptography	3.3.2-1.ph4
alpine 3.13	py3-cryptography	3.3.2-r0
alpine 3.16	py3-cryptography	3.2.2-r0
alpine 3.17	py3-cryptography	3.2.2-r0
alpine 3.18	py3-cryptography	3.2.2-r0
alpine 3.19	py3-cryptography	3.2.2-r0
alpine 3.20	py3-cryptography	3.2.2-r0
alpine 3.21	py3-cryptography	3.2.2-r0

27 kaynaktaki 32 kaydın hepsini göster

Kaynak	Paket	Düzeltildiği sürüm
CBL-Mariner 1.0	python-cryptography	0:3.3.2-1.cm1
Photon OS 1.0	python-cryptography	1.9-1.ph1
Photon OS 2.0	python-cryptography	2.3.1-2.ph2
Photon OS 3.0	python-cryptography	2.8-2.ph3
Photon OS 4.0	python3-cryptography	3.3.2-1.ph4
alpine 3.13	py3-cryptography	3.3.2-r0
alpine 3.16	py3-cryptography	3.2.2-r0
alpine 3.17	py3-cryptography	3.2.2-r0
alpine 3.18	py3-cryptography	3.2.2-r0
alpine 3.19	py3-cryptography	3.2.2-r0
alpine 3.20	py3-cryptography	3.2.2-r0
alpine 3.21	py3-cryptography	3.2.2-r0
alpine 3.22	py3-cryptography	3.2.2-r0
alpine 3.23	py3-cryptography	3.2.2-r0
alpine 3.24	py3-cryptography	3.2.2-r0
alpine edge	py3-cryptography	3.2.2-r0
debian 10	python-cryptography	düzeltme belirtilmemiş
debian 11	python-cryptography	3.3.2-1
debian 12	python-cryptography	3.3.2-1
debian 13	python-cryptography	3.3.2-1
debian 14	python-cryptography	3.3.2-1
echo	python-cryptography	3.3.2-1
Oracle Linux 8	python3-cryptography	3.2.1-4.el8
pip::GitHub Security Advisory pip	cryptography	3.3.2
Red Hat	python-cryptography	düzeltme belirtilmemiş
Red Hat	python2-cryptography	düzeltme belirtilmemiş
Red Hat	python38:3.8::python-cryptography	düzeltme belirtilmemiş
Red Hat	python38:3.8::python3-cryptography	düzeltme belirtilmemiş
Red Hat	python39:3.9::python-cryptography	düzeltme belirtilmemiş
Red Hat	python39:3.9::python3-cryptography	düzeltme belirtilmemiş
rocky 8	python3-cryptography	3.2.1-4.el8
root.io debian 12	rootio-python-cryptography	3.3.2-1

Referanslar

29 referansın hepsi