Stay Secure with the Latest Linux Advisories

security advisorymedium severitydata handling

Ubuntu Security Advisory: USN-4339-1 Medium Level Python-Cryptography Issue

The package python-cryptography before version 3.4-1 is vulnerable to incorrect calculation. . Arch Linux Security Advisory ASA-202102-36 ========================================= Severity: Medium Date : 2021-02-27 CVE-ID : CVE-2020-36242 Package : python-cryptography Type : incorrect calculation Remote : No Link : https://security.archlinux.org/AVG-1541 Summary ====== The package python-cryptography before version 3.4-1 is vulnerable to incorrect calculation. Resolution ========= Upgrade to 3.4-1. # pacman -Syu "python-cryptography> =3.4-1" The problem has been fixed upstream in version 3.4. Workaround ========= None. Description ========== In python-cryptography before version 3.3.2, certain sequences of update calls to symmetrically encrypt multiple gigabytes of data could result in an integer overflow, leading to mishandling of buffers. Impact ===== Unintentional use of the API could lead to buffer mishandling, causing application crashes or incorrectly encrypted data. References ========= https://github.com/pyca/cryptography/security/advisories/GHSA-rhm9-p9w5-fwm7 https://github.com/pyca/cryptography/issues/5615 https://github.com/pyca/cryptography/pull/5747 https://github.com/pyca/cryptography/commit/82b6ce28389f0a317bc55ba2091a74b346db7cae https://security.archlinux.org/CVE-2020-36242 . The Arch Linux Security Advisory ASA-202102-36 addresses erroneous computations found in the python-cryptography library.. python Cryptography, Arch Linux Advisory, Buffer Mishandling. . Severity: Medium. LinuxSecurity.com Team

Mar 01, 2021 •Medium ArchLinux