This repository has been archived by the owner on Aug 21, 2022. It is now read-only.
CVE-2020-36242 (High) detected in cryptography-3.2-cp27-cp27mu-manylinux2010_x86_64.whl #104
Labels
first-timers-only
first-timers-only tickets
good first issue
Good for newcomers
security fix
Security fix generated by WhiteSource
security vulnerability
Security vulnerability detected by WhiteSource
up-for-grabs
CVE-2020-36242 - High Severity Vulnerability
Vulnerable Library - cryptography-3.2-cp27-cp27mu-manylinux2010_x86_64.whl
cryptography is a package which provides cryptographic recipes and primitives to Python developers.
Library home page: https://files.pythonhosted.org/packages/b2/55/b298540fe693643e2b49dfb5ade6ed711f3e1b39159a9f643376325d76a2/cryptography-3.2-cp27-cp27mu-manylinux2010_x86_64.whl
Path to dependency file: covidX/requirements.txt
Path to vulnerable library: covidX/requirements.txt
Dependency Hierarchy:
Found in HEAD commit: 6f3dbcb5ab003a4ef1776b72be10967612787631
Vulnerability Details
In the cryptography package before 3.3.2 for Python, certain sequences of update calls to symmetrically encrypt multi-GB values could result in an integer overflow and buffer overflow, as demonstrated by the Fernet class.
Publish Date: 2021-02-07
URL: CVE-2020-36242
CVSS 3 Score Details (9.1)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://github.com/pyca/cryptography/blob/master/CHANGELOG.rst
Release Date: 2021-02-07
Fix Resolution: cryptography - 3.3.2
Step up your Open Source Security Game with WhiteSource here
The text was updated successfully, but these errors were encountered: