CVE-2020-36242 PyCA Cryptography symmetrically encrypting large values can lead to integer overflow

What is CVE-2020-36242?

CVE-2020-36242 is a critical vulnerability in Fedoraproject Fedora, published on 7 Feb 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

In the cryptography package before 3.3.2 for Python, certain sequences of update calls to symmetrically encrypt multi-GB values could result in an integer overflow and buffer overflow, as demonstrated by the Fernet class.

Weakness: CWE-787, CWE-190

Which versions are affected by CVE-2020-36242?

3 open source packages ship an affected version, including cryptography. It affects 3 products.

Products include Cryptography.io Cryptography, Fedoraproject Fedora, Oracle Communications Cloud Native Core Network Function Cloud Native Environment.

How do I fix CVE-2020-36242?

Upgrade cryptography to 3.3.2 or later.

Is CVE-2020-36242 being exploited?

There is no known exploitation of CVE-2020-36242 in the wild and no public exploit code.

Other vulnerabilities in Fedoraproject Fedora

• CVE-2026-26007 cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves High 8.2
• CVE-2024-26130 cryptography NULL pointer dereference with pkcs12.serialize_key_and_certificates when called with a non-matching certificate and private key and an hmac_hash override High 7.5
• CVE-2023-38325 cryptography mishandles SSH certificates High 7.5
• CVE-2026-39892 cryptography has a buffer overflow if non-contiguous buffers were passed to APIs Medium 6.9
• CVE-2023-49083 cryptography vulnerable to NULL-dereference when loading PKCS7 certificates Medium 5.9

All Fedoraproject Fedora vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as ALPINE-CVE-2020-36242, DEBIAN-CVE-2020-36242, GHSA-rhm9-p9w5-fwm7, MGASA-2021-0129, OESA-2021-1089, PYSEC-2021-63 and 8 more.