CVE-2020-36242

In the cryptography package before 3.3.2 for Python, certain sequences of update calls to symmetrically encrypt multi-GB values could result in an integer overflow and buffer overflow, as demonstrated by the Fernet class.

In the cryptography package before 3.3.2 for Python, certain sequences of update calls to symmetrically encrypt multi-GB values could result in an integer overflow and buffer overflow, as demonstrated by the Fernet class.

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. When certain sequences of update() calls with large values (multiple GBs) for symetric encryption or decryption occur, it's possible for an integer overflow to happen, leading to mishandling of buffers. This is patched in version 3.3.2 and newer.

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers.

Security Fix(es):

In the cryptography package before 3.3.2 for Python, certain sequences of update calls to symmetrically encrypt multi-GB values could result in an integer overflow and buffer overflow, as demonstrated by the Fernet class.(CVE-2020-36242)

The python-cryptography packages contain a Python Cryptographic Authority's (PyCA's) cryptography library, which provides cryptographic primitives and recipes to Python developers.

The following packages have been upgraded to a later upstream version: python-cryptography (3.2.1). (BZ#1873581, BZ#1891947)

Security Fix(es):

• python-cryptography: bleichenbacher timing oracle attack against RSA decryption (CVE-2020-25659)

• python-cryptography: certain sequences of update() calls when symmetrically encrypting very large payloads could result in an integer overflow and lead to buffer overflows (CVE-2020-36242)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.4 Release Notes linked from the References section.

In the cryptography package before 3.3.2 for Python, certain sequences of update calls to symmetrically encrypt multi-GB values could result in an integer overflow and buffer overflow, as demonstrated by the Fernet class.

In the cryptography package before 3.3.2 for Python, certain sequences of update calls to symmetrically encrypt multi-GB values could result in an integer overflow and buffer overflow (CVE-2020-36242).

This update for python-cryptography fixes the following issues:

• CVE-2020-36242: Using the Fernet class to symmetrically encrypt multi gigabyte values could result in an integer overflow and buffer overflow (bsc#1182066).

This update was imported from the SUSE:SLE-15-SP2:Update update project.

These are all security issues fixed in the python36-cryptography-3.3.2-2.4 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python310-cryptography-42.0.5-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python313-cryptography-50.0.0-1.1 package on the GA media of openSUSE Tumbleweed.

In the cryptography package before 3.3.2 for Python, certain sequences of update calls to symmetrically encrypt multi-GB values could result in an integer overflow and buffer overflow, as demonstrated by the Fernet class.

This feature update for venv-salt-minion provides the following changes:

• Introduce venv-salt-minion.
• Track already fixed issues.

This feature update for venv-salt-minion provides the following changes:

• Introduce venv-salt-minion.
• Mention fixed issues provided with the bundle.

This update for python-crcmod, python-cryptography, python-cryptography-vectors contains the following fixes:

python-cryptography:

• Update in SLE-15 (bsc#1177083, jsc#PM-2730, jsc#SLE-18312)
• Refresh patches for new version

• Using the Fernet class to symmetrically encrypt multi gigabyte values. (bsc#1182066, CVE-2020-36242) could result in an integer overflow and buffer overflow.

• update to 2.9.2
  • 2.9.2 - 2020-04-22
    • Updated the macOS wheel to fix an issue where it would not run on macOS versions older than 10.15.
  • 2.9.1 - 2020-04-21
    • Updated Windows, macOS, and manylinux wheels to be compiled with OpenSSL 1.1.1g.
  • 2.9 - 2020-04-02
    • BACKWARDS INCOMPATIBLE: Support for Python 3.4 has been removed due to low usage and maintenance burden.
    • BACKWARDS INCOMPATIBLE: Support for OpenSSL 1.0.1 has been removed. Users on older version of OpenSSL will need to upgrade.
    • BACKWARDS INCOMPATIBLE: Support for LibreSSL 2.6.x has been removed.
    • Removed support for calling public_bytes() with no arguments, as per our deprecation policy. You must now pass encoding and format.
    • BACKWARDS INCOMPATIBLE: Reversed the order in which rfc4514_string() returns the RDNs as required by RFC 4514.
    • Updated Windows, macOS, and manylinux wheels to be compiled with OpenSSL 1.1.1f.
    • Added support for parsing single_extensions in an OCSP response.
    • NameAttribute values can now be empty strings.

Changes in python-cryptography-vectors:

• Update in SLE-15 (bsc#1177083, jsc#PM-2730, jsc#SLE-18312)

• update to 2.9.2:

  • updated vectors for the cryptography 2.9.2 testing

This update for python-cryptography fixes the following issues:

• CVE-2020-36242: Using the Fernet class to symmetrically encrypt multi gigabyte values could result in an integer overflow and buffer overflow (bsc#1182066).

This update for python-cryptography fixes the following issues:

• CVE-2020-36242: Using the Fernet class to symmetrically encrypt multi gigabyte values could result in an integer overflow and buffer overflow (bsc#1182066).

This update for python-cryptography fixes the following issues:

• CVE-2020-36242: Using the Fernet class to symmetrically encrypt multi gigabyte values could result in an integer overflow and buffer overflow (bsc#1182066).

This update for python-cryptography fixes the following issues:

• CVE-2020-36242: Using the Fernet class to symmetrically encrypt multi gigabyte values could result in an integer overflow and buffer overflow (bsc#1182066).

This update for python-cryptography fixes the following issues:

• CVE-2020-36242: Using the Fernet class to symmetrically encrypt multi gigabyte values could result in an integer overflow and buffer overflow (bsc#1182066).

This update for python-cryptography, python-cryptography-vectors fixes the following issues:

• Update in SLE-15 (bsc#1199282, jsc#PM-3243, jsc#SLE-24629)

• CVE-2020-36242: Fixed a bug where certain sequences of update() calls could result in integer overflow (bsc#1182066).

• CVE-2020-25659: Fixed Bleichenbacher vulnerabilities (bsc#1178168).

• update to 3.3.2 (bsc#1198331)

This update for python-crcmod, python-cryptography, python-cryptography-vectors contains the following fixes:

Changes in python-crcmod:

• Include in SLE-15 (bsc#1177083, jsc#PM-2730, jsc#SLE-18312)

• Include in SLE-15 (bsc#1181995, jsc#ECO-3329, jsc#PM-2475)

• Cleanup spec file

• Use fdupes

• Do not bundle html doc

• singlespec auto-conversion

• Include in SLE 12 (FATE #316168)

• Initial release

Changes in python-cryptography:

• Update in SLE-15 (bsc#1177083, jsc#PM-2730, jsc#SLE-18312)

• Refresh patches for new version

• Using the Fernet class to symmetrically encrypt multi gigabyte values. (bsc#1182066, CVE-2020-36242) could result in an integer overflow and buffer overflow.

• update to 2.9.2
  • 2.9.2 - 2020-04-22
    • Updated the macOS wheel to fix an issue where it would not run on macOS versions older than 10.15.
  • 2.9.1 - 2020-04-21
    • Updated Windows, macOS, and manylinux wheels to be compiled with OpenSSL 1.1.1g.
  • 2.9 - 2020-04-02
    • BACKWARDS INCOMPATIBLE: Support for Python 3.4 has been removed due to low usage and maintenance burden.
    • BACKWARDS INCOMPATIBLE: Support for OpenSSL 1.0.1 has been removed. Users on older version of OpenSSL will need to upgrade.
    • BACKWARDS INCOMPATIBLE: Support for LibreSSL 2.6.x has been removed.
    • Removed support for calling public_bytes() with no arguments, as per our deprecation policy. You must now pass encoding and format.
    • BACKWARDS INCOMPATIBLE: Reversed the order in which rfc4514_string() returns the RDNs as required by RFC 4514.
    • Updated Windows, macOS, and manylinux wheels to be compiled with OpenSSL 1.1.1f.
    • Added support for parsing single_extensions in an OCSP response.
    • NameAttribute values can now be empty strings.

Changes in python-cryptography-vectors:

• Update in SLE-15 (bsc#1177083, jsc#PM-2730, jsc#SLE-18312)

• update to 2.9.2:

  • updated vectors for the cryptography 2.9.2 testing

This update for grpc, protobuf, python-Deprecated, python-PyGithub, python-aiocontextvars, python-avro, python-bcrypt, python-cryptography, python-cryptography-vectors, python-google-api-core, python-googleapis-common-protos, python-grpcio-gcp, python-humanfriendly, python-jsondiff, python-knack, python-opencensus, python-opencensus-context, python-opencensus-ext-threading, python-opentelemetry-api, python-psutil, python-pytest-asyncio, python-requests, python-websocket-client, python-websockets fixes the following issues:

grpc:

• Update in SLE-15 (bsc#1197726, bsc#1144068)

protobuf:

• Fix a potential DoS issue in protobuf-cpp and protobuf-python, CVE-2022-1941, bsc#1203681
• Fix a potential DoS issue when parsing with binary data in protobuf-java, CVE-2022-3171, bsc#1204256
• Fix potential Denial of Service in protobuf-java in the parsing procedure for binary data, CVE-2021-22569, bsc#1194530
• Add missing dependency of python subpackages on python-six (bsc#1177127)
• Updated to version 3.9.2 (bsc#1162343)
  • Remove OSReadLittle* due to alignment requirements.
  • Don't use unions and instead use memcpy for the type swaps.
• Disable LTO (bsc#1133277)

python-aiocontextvars:

• Include in SLE-15 (bsc#1199282, jsc#PM-3243, jsc#SLE-24629)

python-avro:

• Include in SLE-15 (bsc#1199282, jsc#PM-3243, jsc#SLE-24629)
• Update in SLE-15 (bsc#1199282, jsc#PM-3243, jsc#SLE-24629)

python-cryptography:

• update to 3.3.2 (bsc#1182066, CVE-2020-36242, bsc#1198331)
  • SECURITY ISSUE: Fixed a bug where certain sequences of update() calls when symmetrically encrypting very large payloads (>2GB) could result in an integer overflow, leading to buffer overflows. CVE-2020-36242

python-cryptography-vectors:

• update to 3.2 (bsc#1178168, CVE-2020-25659):
  • CVE-2020-25659: Attempted to make RSA PKCS#1v1.5 decryption more constant time, to protect against Bleichenbacher vulnerabilities. Due to limitations imposed by our API, we cannot completely mitigate this vulnerability.
  • Support for OpenSSL 1.0.2 has been removed.
  • Added basic support for PKCS7 signing (including SMIME) via PKCS7SignatureBuilder.
• update to 3.3.2 (bsc#1198331)

python-Deprecated:

• Include in SLE-15 (bsc#1199282, jsc#PM-3243, jsc#SLE-24629)
• update to 1.2.13:

python-google-api-core:

• Update to 1.14.2

python-googleapis-common-protos:

• Update to 1.6.0

python-grpcio-gcp:

• Initial spec for v0.2.2

python-humanfriendly:

• Update in SLE-15 (bsc#1199282, jsc#PM-3243, jsc#SLE-24629)
• Update to 10.0

python-jsondiff:

• Update in SLE-15 (bsc#1199282, jsc#PM-3243, jsc#SLE-24629)
• Update to version 1.3.0

python-knack:

• Update in SLE-15 (bsc#1199282, jsc#PM-3243, jsc#SLE-24629)
• Update to version 0.9.0

python-opencensus:

• Include in SLE-15 (bsc#1199282, jsc#PM-3243, jsc#SLE-24629)
• Disable Python2 build
• Update to 0.8.0

python-opencensus-context:

• Include in SLE-15 (bsc#1199282, jsc#PM-3243, jsc#SLE-24629)

python-opencensus-ext-threading:

• Include in SLE-15 (bsc#1199282, jsc#PM-3243, jsc#SLE-24629)
• Initial build version 0.1.2

python-opentelemetry-api:

• Include in SLE-15 (bsc#1199282, jsc#PM-3243, jsc#SLE-24629)
• Version update to 1.5.0

python-psutil:

• Update in SLE-15 (bsc#1199282, jsc#PM-3243, jsc#SLE-24629)
• update to 5.9.1
• remove the dependency on net-tools, since it conflicts with busybox-hostnmame which is default on MicroOS. (bsc#1184753)
• Include in SLE-15 (bsc#1199282, jsc#PM-3243, jsc#SLE-24629)

python-PyGithub:

• Update to 1.43.5:

python-pytest-asyncio:

• Include in SLE-15 (bsc#1199282, jsc#PM-3243, jsc#SLE-24629)
• Initial release of python-pytest-asyncio 0.8.0

python-requests:

• Update in SLE-15 (bsc#1199282, jsc#PM-3243, jsc#SLE-24629)

python-websocket-client:

• Update in SLE-15 (bsc#1199282, jsc#PM-3243, jsc#SLE-24629)
• Update to version 1.3.2

python-websockets:

• Include in SLE-15 (bsc#1199282, jsc#PM-3243, jsc#SLE-24629)
• update to 9.1:

This update for grpc, protobuf, python-Deprecated, python-PyGithub, python-aiocontextvars, python-avro, python-bcrypt, python-cryptography, python-cryptography-vectors, python-google-api-core, python-googleapis-common-protos, python-grpcio-gcp, python-humanfriendly, python-jsondiff, python-knack, python-opencensus, python-opencensus-context, python-opencensus-ext-threading, python-opentelemetry-api, python-psutil, python-pytest-asyncio, python-requests, python-websocket-client, python-websockets fixes the following issues:

grpc:

• Update in SLE-15 (bsc#1197726, bsc#1144068)

protobuf:

• Fix a potential DoS issue in protobuf-cpp and protobuf-python, CVE-2022-1941, bsc#1203681
• Fix a potential DoS issue when parsing with binary data in protobuf-java, CVE-2022-3171, bsc#1204256
• Fix potential Denial of Service in protobuf-java in the parsing procedure for binary data, CVE-2021-22569, bsc#1194530
• Add missing dependency of python subpackages on python-six (bsc#1177127)
• Updated to version 3.9.2 (bsc#1162343)
  • Remove OSReadLittle* due to alignment requirements.
  • Don't use unions and instead use memcpy for the type swaps.
• Disable LTO (bsc#1133277)

python-aiocontextvars:

• Include in SLE-15 (bsc#1199282, jsc#PM-3243, jsc#SLE-24629)

python-avro:

• Include in SLE-15 (bsc#1199282, jsc#PM-3243, jsc#SLE-24629)
• Update in SLE-15 (bsc#1199282, jsc#PM-3243, jsc#SLE-24629)

python-cryptography:

• update to 3.3.2 (bsc#1182066, CVE-2020-36242, bsc#1198331)
  • SECURITY ISSUE: Fixed a bug where certain sequences of update() calls when symmetrically encrypting very large payloads (>2GB) could result in an integer overflow, leading to buffer overflows. CVE-2020-36242

python-cryptography-vectors:

• update to 3.2 (bsc#1178168, CVE-2020-25659):
  • CVE-2020-25659: Attempted to make RSA PKCS#1v1.5 decryption more constant time, to protect against Bleichenbacher vulnerabilities. Due to limitations imposed by our API, we cannot completely mitigate this vulnerability.
  • Support for OpenSSL 1.0.2 has been removed.
  • Added basic support for PKCS7 signing (including SMIME) via PKCS7SignatureBuilder.
• update to 3.3.2 (bsc#1198331)

python-Deprecated:

• Include in SLE-15 (bsc#1199282, jsc#PM-3243, jsc#SLE-24629)
• update to 1.2.13:

python-google-api-core:

• Update to 1.14.2

python-googleapis-common-protos:

• Update to 1.6.0

python-grpcio-gcp:

• Initial spec for v0.2.2

python-humanfriendly:

• Update in SLE-15 (bsc#1199282, jsc#PM-3243, jsc#SLE-24629)
• Update to 10.0

python-jsondiff:

• Update in SLE-15 (bsc#1199282, jsc#PM-3243, jsc#SLE-24629)
• Update to version 1.3.0

python-knack:

• Update in SLE-15 (bsc#1199282, jsc#PM-3243, jsc#SLE-24629)
• Update to version 0.9.0

python-opencensus:

• Include in SLE-15 (bsc#1199282, jsc#PM-3243, jsc#SLE-24629)
• Disable Python2 build
• Update to 0.8.0

python-opencensus-context:

• Include in SLE-15 (bsc#1199282, jsc#PM-3243, jsc#SLE-24629)

python-opencensus-ext-threading:

• Include in SLE-15 (bsc#1199282, jsc#PM-3243, jsc#SLE-24629)
• Initial build version 0.1.2

python-opentelemetry-api:

• Include in SLE-15 (bsc#1199282, jsc#PM-3243, jsc#SLE-24629)
• Version update to 1.5.0

python-psutil:

• Update in SLE-15 (bsc#1199282, jsc#PM-3243, jsc#SLE-24629)
• update to 5.9.1
• remove the dependency on net-tools, since it conflicts with busybox-hostnmame which is default on MicroOS. (bsc#1184753)
• Include in SLE-15 (bsc#1199282, jsc#PM-3243, jsc#SLE-24629)

python-PyGithub:

• Update to 1.43.5:

python-pytest-asyncio:

• Include in SLE-15 (bsc#1199282, jsc#PM-3243, jsc#SLE-24629)
• Initial release of python-pytest-asyncio 0.8.0

python-requests:

• Update in SLE-15 (bsc#1199282, jsc#PM-3243, jsc#SLE-24629)

python-websocket-client:

• Update in SLE-15 (bsc#1199282, jsc#PM-3243, jsc#SLE-24629)
• Update to version 1.3.2

python-websockets:

• Include in SLE-15 (bsc#1199282, jsc#PM-3243, jsc#SLE-24629)
• update to 9.1: