VDB
CVE-2020-36242
CVE-2020-36242
REJECTED
CVSS 9.100000381469727 CRITICAL
In the cryptography package before 3.3.2 for Python, certain sequences of update calls to symmetrically encrypt multi-GB values could result in an integer overflow and buffer overflow, as demonstrated by the Fernet class.
EPSS 6.72% · 93.5th percentile
Risk Scores
CVSS 3.1
9.100000381469727
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
EPSS Score
6.72%
93.5th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ubuntu:18.04:LTS | python-cryptography | 0, 1.9-1, 2.1.3-3 |
| Ubuntu:16.04:LTS | python-cryptography | 1.2.3-1ubuntu0.2, 1.1.1-1, 1.1.1-1ubuntu1 |
| Ubuntu:20.04:LTS | python-cryptography | 2.6.1-3.1, 2.6.1-4, 2.6.1-4ubuntu1 |
Timeline
- CVE Published
- Apr 8, 2021 PoC Published
- Apr 14, 2021 EPSS Score
- Jan 6, 2022 EPSS Score
- Apr 1, 2022 EPSS Score
- Mar 7, 2023 EPSS Score
- Feb 13, 2025 PoC Published
- Mar 18, 2025 EPSS Score
- Mar 19, 2025 EPSS Score
- Mar 24, 2025 EPSS Score
- Mar 25, 2025 EPSS Score
- Mar 28, 2025 EPSS Score
References
- https://ubuntu.com/security/CVE-2020-36242 third-party-advisory
- https://github.com/pyca/cryptography/blob/master/CHANGELOG.rst third-party-advisory
- https://github.com/pyca/cryptography/compare/3.3.1...3.3.2 third-party-advisory
- https://www.cve.org/CVERecord?id=CVE-2020-36242 third-party-advisory
- Multiples vulnérabilités dans les produits IBM advisory