CVE-2020-36242: Integer Overflow
A buffer-overflow flaw was found in the python-cryptography package. In certain sequences of update() calls when symmetrically encrypting very large payloads (>2GB) could result in an integer overflow, leading to buffer overflows. Note: This fix is a workaround for the OpenSSL CVE-2021-23840 flaw. Source: pyca/cryptography project
Other sources
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. When certain sequences of update() calls with large values (multiple GBs) for symetric encryption or decryption occur, it's possible for an integer overflow to happen, leading to mishandling of buffers. This is patched in version 3.3.2 and newer.
— GitHub
In the cryptography package before 3.3.2 for Python, certain sequences of update calls to symmetrically encrypt multi-GB values could result in an integer overflow and buffer overflow, as demonstrated by the Fernet class.
oauthlib is vulnerable to a man-in-the-middle attack, caused by the lack of support for PKCE implementation. An attacker could exploit this vulnerability to launch a man-in-the-middle attack and gain access to the communication channel between endpoints to obtain sensitive information or further compromise the system.
— IBM
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Information
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2020-36242?
CVE-2020-36242 is a vulnerability in the cryptography package for Python that allows for integer overflow during symmetrical encryption or decryption.
What is the severity of CVE-2020-36242?
The severity of CVE-2020-36242 is critical with a CVSS score of 9.1.
Which software is affected by CVE-2020-36242?
The cryptography package for Python versions up to and including 3.3.2, Oracle Communications Cloud Native Core Network Function Cloud Native Environment version 1.10.0, and Fedora version 33 are affected by CVE-2020-36242.
How can I fix CVE-2020-36242?
To fix CVE-2020-36242, update to version 3.3.2 of the cryptography package for Python.
Where can I find more information about CVE-2020-36242?
You can find more information about CVE-2020-36242 on the CVE website, NIST's vulnerability database, the cryptography package's changelog, the Red Hat bugzilla page, and the Red Hat errata page.