critical

CVE-2020-36242

python-cryptography: Large inputs for symmetric encryption can trigger integer overflow leading to buffer overflow

Published 7 Feb 2021Modified 17 Jun 2026CWE 190, 787

In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.

Severity by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

GHSA8.8CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N

Red Hat8.2CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

Trivy's own label is CRITICAL. Rated critical by NVD, CBL-Mariner, Photon OS. Rated lower by GHSA (high), Red Hat (medium), Oracle (medium), Rocky Linux (medium).

Description

In the cryptography package before 3.3.2 for Python, certain sequences of update calls to symmetrically encrypt multi-GB values could result in an integer overflow and buffer overflow, as demonstrated by the Fernet class.

Affected packages and fixed versions

Source	Package	Fixed in
CBL-Mariner 1.0	python-cryptography	0:3.3.2-1.cm1
Photon OS 1.0	python-cryptography	1.9-1.ph1
Photon OS 2.0	python-cryptography	2.3.1-2.ph2
Photon OS 3.0	python-cryptography	2.8-2.ph3
Photon OS 4.0	python3-cryptography	3.3.2-1.ph4
alpine 3.13	py3-cryptography	3.3.2-r0
alpine 3.16	py3-cryptography	3.2.2-r0
alpine 3.17	py3-cryptography	3.2.2-r0
alpine 3.18	py3-cryptography	3.2.2-r0
alpine 3.19	py3-cryptography	3.2.2-r0
alpine 3.20	py3-cryptography	3.2.2-r0
alpine 3.21	py3-cryptography	3.2.2-r0

Show all 32 entries from 27 sources

Source	Package	Fixed in
CBL-Mariner 1.0	python-cryptography	0:3.3.2-1.cm1
Photon OS 1.0	python-cryptography	1.9-1.ph1
Photon OS 2.0	python-cryptography	2.3.1-2.ph2
Photon OS 3.0	python-cryptography	2.8-2.ph3
Photon OS 4.0	python3-cryptography	3.3.2-1.ph4
alpine 3.13	py3-cryptography	3.3.2-r0
alpine 3.16	py3-cryptography	3.2.2-r0
alpine 3.17	py3-cryptography	3.2.2-r0
alpine 3.18	py3-cryptography	3.2.2-r0
alpine 3.19	py3-cryptography	3.2.2-r0
alpine 3.20	py3-cryptography	3.2.2-r0
alpine 3.21	py3-cryptography	3.2.2-r0
alpine 3.22	py3-cryptography	3.2.2-r0
alpine 3.23	py3-cryptography	3.2.2-r0
alpine 3.24	py3-cryptography	3.2.2-r0
alpine edge	py3-cryptography	3.2.2-r0
debian 10	python-cryptography	no fix listed
debian 11	python-cryptography	3.3.2-1
debian 12	python-cryptography	3.3.2-1
debian 13	python-cryptography	3.3.2-1
debian 14	python-cryptography	3.3.2-1
echo	python-cryptography	3.3.2-1
Oracle Linux 8	python3-cryptography	3.2.1-4.el8
pip::GitHub Security Advisory pip	cryptography	3.3.2
Red Hat	python-cryptography	no fix listed
Red Hat	python2-cryptography	no fix listed
Red Hat	python38:3.8::python-cryptography	no fix listed
Red Hat	python38:3.8::python3-cryptography	no fix listed
Red Hat	python39:3.9::python-cryptography	no fix listed
Red Hat	python39:3.9::python3-cryptography	no fix listed
rocky 8	python3-cryptography	3.2.1-4.el8
root.io debian 12	rootio-python-cryptography	3.3.2-1

References

All 29 references