Description
In the cryptography package before 3.3.2 for Python, certain sequences of update calls to symmetrically encrypt multi-GB values could result in an integer overflow and buffer overflow, as demonstrated by the Fernet class.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n/a n/a
n/aaffected
References
- https://github.com/pyca/cryptography/issues/5615 ↗
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L7RGQLK4J5ZQFRLKCHVVG6BKZTUQMG7E/ ↗
- https://www.oracle.com/security-alerts/cpuapr2022.html ↗
- https://github.com/pyca/cryptography/compare/3.3.1...3.3.2 ↗
- https://github.com/pyca/cryptography/blob/master/CHANGELOG.rst ↗
- https://www.oracle.com/security-alerts/cpujul2022.html ↗