CVE-2020-36242
CriticalSummary
In the cryptography package for Python before version 3.3.2, sequences of update calls for symmetric encryption of multi-GB data can cause integer overflow and buffer overflow, as demonstrated with the Fernet class.
Risk Assessment
An attacker could exploit this vulnerability to execute arbitrary code or cause a denial of service, posing a serious threat to the integrity and availability of systems using the cryptography library for large data encryption.
Recommendation
Immediately upgrade the cryptography package to version 3.3.2 or later to mitigate the buffer overflow risk.
Original NVD description (English source)
In the cryptography package before 3.3.2 for Python, certain sequences of update calls to symmetrically encrypt multi-GB values could result in an integer overflow and buffer overflow, as demonstrated by the Fernet class.