Integer Overflow or Wraparound Affecting python-cryptography package, versions <3.3.2-1
Threat Intelligence
EPSS
0.85% (83rd
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-DEBIAN13-PYTHONCRYPTOGRAPHY-5693605
- published 8 Feb 2021
- disclosed 7 Feb 2021
How to fix?
Upgrade Debian:13 python-cryptography to version 3.3.2-1 or higher.
NVD Description
Note: Versions mentioned in the description apply only to the upstream python-cryptography package and not the python-cryptography package as distributed by Debian.
See How to fix? for Debian:13 relevant fixed versions and status.
In the cryptography package before 3.3.2 for Python, certain sequences of update calls to symmetrically encrypt multi-GB values could result in an integer overflow and buffer overflow, as demonstrated by the Fernet class.
References
- https://security-tracker.debian.org/tracker/CVE-2020-36242
- https://github.com/pyca/cryptography/blob/master/CHANGELOG.rst
- https://github.com/pyca/cryptography/compare/3.3.1...3.3.2
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L7RGQLK4J5ZQFRLKCHVVG6BKZTUQMG7E/
- https://github.com/pyca/cryptography/issues/5615
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L7RGQLK4J5ZQFRLKCHVVG6BKZTUQMG7E/
CVSS Scores
version 3.1