Lucene search

K

GoogleOSV:GHSA-RHM9-P9W5-FWM7

HistoryFeb 10, 2021 - 1:32 a.m.

PyCA Cryptography symmetrically encrypting large values can lead to integer overflow

2021-02-1001:32:27

Google

osv.dev

32

cryptography

symmetric encryption

integer overflow

patched

python

AI Score

9.2

Confidence

High

EPSS

0.008

Percentile

82.3%

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. When certain sequences of update() calls with large values (multiple GBs) for symetric encryption or decryption occur, it’s possible for an integer overflow to happen, leading to mishandling of buffers. This is patched in version 3.3.2 and newer.

References

github.com/pyca/cryptography

github.com/pyca/cryptography/blob/master/CHANGELOG.rst

github.com/pyca/cryptography/commit/82b6ce28389f0a317bc55ba2091a74b346db7cae

github.com/pyca/cryptography/compare/3.3.1...3.3.2

github.com/pyca/cryptography/issues/5615

github.com/pyca/cryptography/security/advisories/GHSA-rhm9-p9w5-fwm7

lists.fedoraproject.org/archives/list/[email protected]/message/L7RGQLK4J5ZQFRLKCHVVG6BKZTUQMG7E

nvd.nist.gov/vuln/detail/CVE-2020-36242

www.oracle.com/security-alerts/cpuapr2022.html

www.oracle.com/security-alerts/cpujul2022.html

AI Score

9.2

Confidence

High

EPSS

0.008

Percentile

82.3%

Related for OSV:GHSA-RHM9-P9W5-FWM7