VDB
PYSEC-2021-63
PYSEC-2021-63
PUBLISHED
CVSS 9.300000190734863 CRITICAL
In the cryptography package before 3.3.2 for Python, certain sequences of update calls to symmetrically encrypt multi-GB values could result in an integer overflow and buffer overflow, as demonstrated by the Fernet class.
Risk Scores
CVSS v4.0
9.300000190734863
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| PyPI | cryptography | 3.1, 3.1.1, 3.2 |
Timeline
- Feb 7, 2021 CVE Published
- Nov 8, 2023 CVE Updated
References
- https://github.com/pyca/cryptography/blob/master/CHANGELOG.rst url
- https://github.com/pyca/cryptography/compare/3.3.1...3.3.2 url
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L7RGQLK4J5ZQFRLKCHVVG6BKZTUQMG7E/ url
- https://github.com/advisories/GHSA-rhm9-p9w5-fwm7 advisory
- https://github.com/pyca/cryptography/issues/5615 discussion