In the cryptography package before 3.3.2 for Python certain sequences of update calls to symmetrically encrypt multi-GB values could result in an integer overflow and buffer overflow as demonstrated by the Fernet class.

🗓️ 10 Feb 2021 08:00:00Reported by MicrosoftType

mscve

mscve🔗 msrc.microsoft.com👁 3 Views

In Python cryptography before 3.3.2, Fernet updates with multi gigabyte data could cause overflows.

Reporter	Title	Published	Views	Family All 244
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Python cryptography	1 Oct 202106:20	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in the Python, Python cryptography , and Urllib3 affect IBM Spectrum Discover.	30 Jul 202105:01	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar Advisor With Watson uses components with known vulnerabilities (CVE-2020-36242, CVE-2021-33503, CVE-2020-28493)	20 Oct 202119:08	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar SIEM contains multiple vulnerabilities	15 Apr 202502:20	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Network Automation 2.7.3 addresses multiple security vulnerabilities	26 Mar 202504:10	–	ibm
Tenable Nessus	Alibaba Cloud Linux 3 : 0083: python-cryptography (ALINUX3-SA-2022:0083)	14 May 202500:00	–	nessus
Tenable Nessus	AlmaLinux 8 : python-cryptography (ALSA-2021:1608)	9 Feb 202200:00	–	nessus
Tenable Nessus	CentOS 8 : python-cryptography (CESA-2021:1608)	19 May 202100:00	–	nessus
Tenable Nessus	EulerOS Virtualization 2.9.1 : python-cryptography (EulerOS-SA-2021-2178)	13 Jul 202100:00	–	nessus
Tenable Nessus	EulerOS Virtualization 2.9.0 : python-cryptography (EulerOS-SA-2021-2208)	13 Jul 202100:00	–	nessus

Vulners

Node

microsoft cm1_python-cryptography_3.3.2-1Range<3.3.2-1

10 Feb 2021 08:00Current

7High risk

Vulners AI Score7

CVSS 26.4

CVSS 3.19.1

EPSS0.06718

cryptography package python fernet class integer overflow buffer overflow multi gigabyte data