rpms/python-cryptography
3
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

CVE-2020-36242

Browse source 
Fixed a bug where certain sequences of update() calls when symmetrically
encrypting very large payloads (>2GB) could result in an integer overflow,
leading to buffer overflows.

Resolves: rhbz#1926227
This commit is contained in:
Christian Heimes 2021-02-08 15:30:51 +01:00
commit b0108c0719
2 changed files with 27 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

18
CVE-2020-36242.patch Normal file
View file

@ -0,0 +1,18 @@
From 962eac3925c7184fb5dc174357823223beba0d85 Mon Sep 17 00:00:00 2001
From: Paul Kehrer <paul.l.kehrer@gmail.com>
Date: Sun, 7 Feb 2021 11:04:43 -0600
Subject: [PATCH] port changelog and fix back to master for CVE-2020-36242
diff --git a/src/cryptography/hazmat/backends/openssl/ciphers.py b/src/cryptography/hazmat/backends/openssl/ciphers.py
index 2b10681b31..0f96795fdc 100644
--- a/src/cryptography/hazmat/backends/openssl/ciphers.py
+++ b/src/cryptography/hazmat/backends/openssl/ciphers.py
@@ -16,7 +16,7 @@
class _CipherContext(object):
_ENCRYPT = 1
_DECRYPT = 0
- _MAX_CHUNK_SIZE = 2 ** 31 - 1
+ _MAX_CHUNK_SIZE = 2 ** 30 - 1
def __init__(self, backend, cipher, mode, operation):
self._backend = backend

10
python-cryptography.spec
View file

@ -20,7 +20,7 @@
Name: python-%{srcname}
Version: 3.2.1
Release: 1%{?dist}
Release: 2%{?dist}
Summary: PyCA's cryptography library
License: ASL 2.0 or BSD
@ -33,6 +33,8 @@ Source1: %{pypi_source}.asc
# gpg2 --export --export-options export-minimal "05FD 9FA1 6CF7 5735 0D91 A560 235A E5F1 29F9 ED98" > gpgkey-05FD_9FA1_6CF7_5735_0D91_A560_235A_E5F1_29F9_ED98.gpg
Source2: gpgkey-05FD_9FA1_6CF7_5735_0D91_A560_235A_E5F1_29F9_ED98.gpg
Patch0001: CVE-2020-36242.patch
BuildRequires: openssl-devel
BuildRequires: gcc
BuildRequires: gnupg2
@ -170,6 +172,12 @@ PYTHONPATH=%{buildroot}%{python3_sitearch} %{__python3} -m pytest -k "not (test_
%changelog
* Mon Feb 08 2021 Christian Heimes <cheimes@redhat.com> - 3.2.1-2
- CVE-2020-36242: Fixed a bug where certain sequences of update() calls
when symmetrically encrypting very large payloads (>2GB) could result
in an integer overflow, leading to buffer overflows.
- Resolves: rhbz#1926227
* Wed Oct 28 2020 Christian Heimes <cheimes@redhat.com> - 3.2.1-1
- Update to 3.2.1 (#1892153)