WaratekVRT Sign in

CVE-2020-36242 cryptography

Affected softwarecryptography
Severity9.1 Critical CVSS 3.1 2 scores
WeaknessInteger overflow (CWE-190)
Published7 Feb 2021
Updated17 Jun 2026

Description

In the cryptography package before 3.3.2 for Python, certain sequences of update calls to symmetrically encrypt multi-GB values could result in an integer overflow and buffer overflow, as demonstrated by the Fernet class.

CWE-787 · Out-of-bounds write

Exploitation status

No public exploit

No exploit has been reported in the sources we check. Published 5 years ago.
  • CISA KEV not listed
  • VulnCheck KEV not listed
  • CISA Vulnrichment no assessment published
  • Indexed PoC none indexed
  • EPSS 6.8% chance in 30 days

Waratek protection

Outside Waratek scope

A Java vulnerability, but not one Waratek protects. It affects only Java on a user's desktop (applets, Web Start, JavaFX, the installer), sits in a product the Waratek agent can't be installed into, or is in a package we don't expect in business applications. The decision below says which.

  • Protection none
  • Action not pursued none
  • Review human Researcher
  • Record active
Decided by Manual classification of this CVE in the legacy dataset
Finding A manual classification set this CVE's status to Outside Waratek scope, but the CVE names a tracked product.

CVSS

9.1 CRITICAL v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H 2 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.1 9.1 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H NVD Primary published
CVSS 2.0 6.4 none AV:N/AC:L/Au:N/C:P/I:N/A:P NVD Primary

Affected software and releases

Oracle advisories

AdvisoryTypeQuarterProducts Oracle names in its risk matrix
Oracle Critical Patch Update January 2023 ↗ CPU 2023-Q1 Oracle MySQL / Shell: Core Client (cryptography) (8.0.31 and prior)
Oracle's note: CVE-2020-36242 is non-exploitable in MySQL Shell, because it is a flaw in cryptography that is distributed in the MySQL Shell and the affected module in cryptography is not a functional dependency in MySQL Shell.
Oracle Critical Patch Update April 2022 ↗ CPU 2022-Q2 Oracle Communications / OC-CNE (python-cryptography) (1.10.0)

Oracle components and versions

FamilyComponentVersions, as Oracle lists themRead as
Oracle Communications OC-CNE (python-cryptography) 1.10.0 1.10.0
Oracle MySQL Shell: Core Client (cryptography) 8.0.31 and prior

Products and versions

3 products, 3 version entries
SourceVendorProductSchemeAffected versions
nvd cryptography.io cryptography generic ＜ 3.3.2
nvd fedoraproject fedora generic 33
nvd oracle communications cloud native core network function cloud native environment generic 1.10.0

References

URLTags
https://github.com/pyca/cryptography/blob/master/CHANGELOG.rst Release Notes, Third Party Advisory
https://github.com/pyca/cryptography/compare/3.3.1...3.3.2 Patch, Third Party Advisory
https://github.com/pyca/cryptography/issues/5615 Exploit, Patch, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L7RGQLK4J5ZQFRLKCHVVG6BKZTUQMG7E/
https://www.oracle.com/security-alerts/cpuapr2022.html Patch, Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2022.html Patch, Third Party Advisory

Timeline
Published2021-02-07By the CVE Program.
NVD record modified2026-06-17NVD's own last-modified date for this record.