VYPR
← All advisories
High severityNVD Advisory· Published Feb 7, 2021· Updated Aug 4, 2024

CVE-2020-36242

CVE-2020-36242

Description

In the cryptography package before 3.3.2 for Python, certain sequences of update calls to symmetrically encrypt multi-GB values could result in an integer overflow and buffer overflow, as demonstrated by the Fernet class.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Integer overflow in Python cryptography package before 3.3.2 leads to buffer overflow when encrypting multi-GB data with Fernet.

Vulnerability

Details

CVE-2020-36242 is an integer overflow vulnerability in the Python cryptography package (versions before 3.3.2). When encrypting very large data (multi-GB) using symmetric encryption (e.g., the Fernet class), a series of update() calls can cause an integer overflow, leading to a heap buffer overflow [2].

Exploitation

To exploit this, an attacker must be able to supply data that gets encrypted by the vulnerable code, typically by intercepting or crafting input to an application that uses Fernet with large plaintexts. No special privileges are required beyond the ability to trigger encryption operations on large data volumes [3].

Impact

Successful exploitation could result in memory corruption, potentially allowing arbitrary code execution. The integrity and availability of the application may be compromised.

Mitigation

The vulnerability was patched in cryptography version 3.3.2. Users should upgrade immediately. No workarounds are known if encryption of multi-GB data is required [4].

References
  1. NVD - CVE-2020-36242
  2. CVE-2020-36242 - GitHub Advisory Database
  3. correct buffer overflows cause by integer overflow in openssl (#5747) · pyca/cryptography@82b6ce2

AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
cryptographyPyPI
>= 3.1, < 3.3.23.3.2

Affected products

1340

Patches

1
82b6ce28389f

correct buffer overflows cause by integer overflow in openssl (#5747)

https://github.com/pyca/cryptographyAlex GaynorFeb 7, 2021via ghsa
commit
8 files changed · +21 −12
  • CHANGELOG.rst+9 −0 modified
    @@ -1,6 +1,15 @@
 Changelog
 =========
 
+.. _v3-3-2:
+
+3.3.2 - 2021-02-07
+~~~~~~~~~~~~~~~~~~
+
+* **SECURITY ISSUE:** Fixed a bug where certain sequences of ``update()`` calls
+  when symmetrically encrypting very large payloads (>2GB) could result in an
+  integer overflow, leading to buffer overflows. *CVE-2020-36242*
+
 .. _v3-3-1:
 
 3.3.1 - 2020-12-09
  • docs/conf.py+1 −1 modified
    @@ -71,7 +71,7 @@
 
 # General information about the project.
 project = "Cryptography"
-copyright = "2013-2020, Individual Contributors"
+copyright = "2013-2021, Individual Contributors"
 
 # The version info for the project you're documenting, acts as replacement for
 # |version| and |release|, also used in various other places throughout the
  • .github/workflows/ci.yml+2 −2 modified
    @@ -82,7 +82,7 @@ jobs:
 
   linux-distros:
     runs-on: ubuntu-latest
-    container: ${{ matrix.IMAGE.IMAGE }}
+    container: ghcr.io/${{ matrix.IMAGE.IMAGE }}
     strategy:
       matrix:
         IMAGE:
@@ -91,7 +91,7 @@ jobs:
           - {IMAGE: "pyca/cryptography-runner-centos8-fips", TOXENV: "py36", FIPS: true}
           - {IMAGE: "pyca/cryptography-runner-stretch", TOXENV: "py27"}
           - {IMAGE: "pyca/cryptography-runner-buster", TOXENV: "py37"}
-          - {IMAGE: "pyca/cryptography-runner-bullseye", TOXENV: "py38"}
+          - {IMAGE: "pyca/cryptography-runner-bullseye", TOXENV: "py39"}
           - {IMAGE: "pyca/cryptography-runner-sid", TOXENV: "py39"}
           - {IMAGE: "pyca/cryptography-runner-ubuntu-bionic", TOXENV: "py36"}
           - {IMAGE: "pyca/cryptography-runner-ubuntu-focal", TOXENV: "py38"}
  • .github/workflows/wheel-builder.yml+1 −1 modified
    @@ -8,7 +8,7 @@ on:
 jobs:
   manylinux:
     runs-on: ubuntu-latest
-    container: ${{ matrix.MANYLINUX.CONTAINER }}
+    container: ghcr.io/${{ matrix.MANYLINUX.CONTAINER }}
     strategy:
       matrix:
         PYTHON: ["cp27-cp27m", "cp27-cp27mu", "cp36-cp36m"]
  • src/cryptography/__about__.py+2 −2 modified
    @@ -22,10 +22,10 @@
 )
 __uri__ = "https://github.com/pyca/cryptography"
 
-__version__ = "3.3.1"
+__version__ = "3.3.2"
 
 __author__ = "The cryptography developers"
 __email__ = "cryptography-dev@python.org"
 
 __license__ = "BSD or Apache License, Version 2.0"
-__copyright__ = "Copyright 2013-2020 {}".format(__author__)
+__copyright__ = "Copyright 2013-2021 {}".format(__author__)
  • src/cryptography/hazmat/backends/openssl/ciphers.py+1 −1 modified
    @@ -17,7 +17,7 @@
 class _CipherContext(object):
     _ENCRYPT = 1
     _DECRYPT = 0
-    _MAX_CHUNK_SIZE = 2 ** 31 - 1
+    _MAX_CHUNK_SIZE = 2 ** 30 - 1
 
     def __init__(self, backend, cipher, mode, operation):
         self._backend = backend
  • vectors/cryptography_vectors/__about__.py+2 −2 modified
    @@ -20,10 +20,10 @@
 
 __uri__ = "https://github.com/pyca/cryptography"
 
-__version__ = "3.3.1"
+__version__ = "3.3.2"
 
 __author__ = "The cryptography developers"
 __email__ = "cryptography-dev@python.org"
 
 __license__ = "BSD or Apache License, Version 2.0"
-__copyright__ = "Copyright 2013-2020 %s" % __author__
+__copyright__ = "Copyright 2013-2021 %s" % __author__
  • .zuul.d/jobs.yaml+3 −3 modified
    @@ -44,7 +44,7 @@
     vars:
       wheel_builds:
         - platform: manylinux2014_aarch64
-          image: pyca/cryptography-manylinux2014_aarch64
+          image: ghcr.io/pyca/cryptography-manylinux2014_aarch64
           pythons:
             - cp36-cp36m
 
@@ -55,13 +55,13 @@
     vars:
       wheel_builds:
         - platform: manylinux1_x86_64
-          image: pyca/cryptography-manylinux1:x86_64
+          image: ghcr.io/pyca/cryptography-manylinux1:x86_64
           pythons:
             - cp27-cp27m
             - cp27-cp27mu
             - cp36-cp36m
         - platform: manylinux2010_x86_64
-          image: pyca/cryptography-manylinux2010:x86_64
+          image: ghcr.io/pyca/cryptography-manylinux2010:x86_64
           pythons:
             - cp27-cp27m
             - cp27-cp27mu

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

13

News mentions

0

No linked articles in our index yet.