Vulnerability Description
A flaw was found in python-cryptography versions between >=1.9.0 and <2.3. The finalize_with_tag API did not enforce a minimum tag length. If a user did not validate the input length prior to passing it to finalize_with_tag an attacker could craft an invalid payload with a shortened tag (e.g. 1 byte) such that they would have a 1 in 256 chance of passing the MAC check. GCM tag forgeries can cause key leakage.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Cryptography | Python-Cryptography | >= 1.9.0, < 2.3 |
| Redhat | Openstack | 13 |
| Canonical | Ubuntu Linux | 18.04 |
Related Weaknesses (CWE)
References
- https://access.redhat.com/errata/RHSA-2018:3600
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10903Issue TrackingPatchThird Party Advisory
- https://github.com/pyca/cryptography/pull/4342/commits/688e0f673bfbf43fa89899432PatchThird Party Advisory
- https://usn.ubuntu.com/3720-1/Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:3600
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10903Issue TrackingPatchThird Party Advisory
- https://github.com/pyca/cryptography/pull/4342/commits/688e0f673bfbf43fa89899432PatchThird Party Advisory
- https://usn.ubuntu.com/3720-1/Third Party Advisory
FAQ
What is CVE-2018-10903?
CVE-2018-10903 is a vulnerability with a CVSS score of 7.5 (HIGH). A flaw was found in python-cryptography versions between >=1.9.0 and <2.3. The finalize_with_tag API did not enforce a minimum tag length. If a user did not validate the input length prior to passing ...
How severe is CVE-2018-10903?
CVE-2018-10903 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2018-10903?
Check the references section above for vendor advisories and patch information. Affected products include: Cryptography Python-Cryptography, Redhat Openstack, Canonical Ubuntu Linux.