CVE-2020-36242

CVE-2020-36242 describes an integer overflow and subsequent buffer overflow vulnerability in the Python cryptography package, specifically impacting versions prior to 3.3.2. This flaw can occur when symmetrically encrypting multi-gigabyte values through repeated update calls, as demonstrated by the Fernet class, and affects various products incorporating this library, including Fedora and Oracle communications components. Rated as Critical with a CVSS score of 9.1, this vulnerability is network-exploitable with low attack complexity, requiring no user interaction or privileges. A successful exploit could lead to a complete loss of confidentiality and availability (C:H/A:H), though integrity is not directly impacted. Despite its critical severity, there is currently no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. The vulnerability has also received minimal community discussion or media coverage, suggesting a low level of public awareness or attention.