CVE-2020-36242: Integer Overflow and Buffer Overflow in cryptography Package
Summary
CVE-2020-36242: In the cryptography package before 3.3.2 for Python, certain sequences of update calls to symmetrically encrypt multi-GB values could result in an integer overflow and buffer overflow, as demonstrated by the Fernet class... Affects cryptography versions >= 3.1, < 3.3.2. Fixed in 3.3.2. How to fix ↓
Also tracked for
- py3-cryptography · Alpine:v3.13
The same CVE-2020-36242 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The cryptography package is a Python library that provides cryptographic recipes and primitives. It is commonly used for secure communication, data storage, and authentication. The package offers various functionalities such as encryption, decryption, key generation, and hashing. However, versions before 3.3.2 of the cryptography package are vulnerable to an integer overflow and buffer overflow issue.
Vulnerability Detail
The vulnerability (CVE-2020-36242) arises from certain sequences of update calls to symmetrically encrypt multi-GB values using the Fernet class. These sequences can trigger an integer overflow and buffer overflow. An attacker could exploit this vulnerability to execute arbitrary code, cause a denial-of-service condition, or gain unauthorized access to sensitive information. The impact of this vulnerability is particularly severe when handling large encrypted values.
How To Fix
Latest published version: 50.0.2 as of 22 Oct 2026
pip install --upgrade "cryptography==50.0.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.3.2
This is the first release that contains the fix.
pip install --upgrade "cryptography==3.3.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, users can mitigate the risk by ensuring they are using version 3.3.2 or later of the cryptography package.
Conclusion
The vulnerability (CVE-2020-36242) in the cryptography package before version 3.3.2 can result in an integer overflow and buffer overflow. It is crucial to update to version 3.3.2 or later to mitigate the risk of arbitrary code execution, denial-of-service, or unauthorized access to sensitive information. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for cryptography →
FAQ
The vulnerability can lead to arbitrary code execution, denial-of-service, or unauthorized access to sensitive information.
Versions before 3.3.2 of the cryptography package are affected.
Upgrade to version 3.3.2 or later of the cryptography package.
There is no specific workaround mentioned, but using version 3.3.2 or later can mitigate the risk.
For more information, refer to the official advisory at https://github.com/pypa/advisory-database/blob/main/vulns/cryptography/PYSEC-2021-63.yaml
References
Related vulnerabilities
Recent vulnerabilities recorded for cryptography.
