Vulnerability Database
289,599
Total vulnerabilities in the database
CVE-2018-10903
A flaw was found in python-cryptography versions between >=1.9.0 and <2.3. The finalize_with_tag API did not enforce a minimum tag length. If a user did not validate the input length prior to passing it to finalize_with_tag an attacker could craft an invalid payload with a shortened tag (e.g. 1 byte) such that they would have a 1 in 256 chance of passing the MAC check. GCM tag forgeries can cause key leakage.
| Software | From | Fixed in |
|---|---|---|
| cryptography / python-cryptography | 1.9.0 | 2.3 |
| canonical / ubuntu_linux | 18.04 | 18.04.x |
| redhat / openstack | 13 | 13.x |
cryptography
|
1.9.0 | 2.3 |