CVE-2020-36242: 
Python vulnerability analysis and mitigation

In the cryptography package before version 3.3.2 for Python, certain sequences of update calls to symmetrically encrypt multi-GB values could result in an integer overflow and buffer overflow, as demonstrated by the Fernet class. The vulnerability was discovered and disclosed on February 7, 2021, and is tracked as CVE-2020-36242 (NVD, MITRE).

The vulnerability occurs when using the Fernet class to encrypt large data (>2GiB). The issue stems from an integer overflow in OpenSSL that occurs during symmetric encryption operations. When attempting to encrypt data sizes around 2^31 - 1 bytes or larger, the integer overflow can lead to buffer overflows. The vulnerability was fixed in cryptography version 3.3.2 by correcting the buffer overflow caused by integer overflow in OpenSSL (GitHub Changelog).

If exploited, this vulnerability could result in buffer overflows, potentially leading to application crashes or arbitrary code execution. The vulnerability affects applications using the Python cryptography package for encrypting large amounts of data, particularly when using the Fernet class for symmetric encryption of files larger than 2GB (GitHub Issue).

The recommended mitigation is to upgrade to cryptography version 3.3.2 or later, which contains the fix for this vulnerability. The issue was resolved by correcting the buffer overflow caused by integer overflow in OpenSSL (GitHub Changelog).