This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2020-36242 →

DEBIAN-CVE-2020-36242

In the cryptography package before 3.3.2 for Python, certain sequences of update calls to symmetrically encrypt multi-GB values could result in an int...

Original description

The description as published by the source.

In the cryptography package before 3.3.2 for Python, certain sequences of update calls to symmetrically encrypt multi-GB values could result in an integer overflow and buffer overflow, as demonstrated by the Fernet class.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 python-cryptography

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.2-1"}]}]

Debian:13 python-cryptography

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.2-1"}]}]

Debian:14 python-cryptography

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.2-1"}]}]

References

advisory security-tracker.debian.org