CVE-2020-36242

2021-02-0700:00:00

ubuntu.com

cryptography package

integer overflow

buffer overflow

python

symmetric encryption

CVSS2

6.4

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:N/A:P

CVSS3

9.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

EPSS

0.008

Percentile

82.3%

JSON

In the cryptography package before 3.3.2 for Python, certain sequences of
update calls to symmetrically encrypt multi-GB values could result in an
integer overflow and buffer overflow, as demonstrated by the Fernet class.

Bugs

<https://github.com/pyca/cryptography/issues/5615>

Notes

Author	Note
mdeslaur	Versions in groovy and earlier don’t support chunking in update_into. Attempting reproducer on groovy and focal errors out with: OverflowError: integer 4294967296 does not fit ‘32-bit int’ which seems to indicate there is a size check being performed and they aren’t vulnerable to this issue.