CVE-2018-10903: Input Validation
A flaw was found in python-cryptography versions between >=1.9.0 and <2.3. The finalizewithtag API did not enforce a minimum tag length. If a user did not validate the input length prior to passing it to finalizewithtag an attacker could craft an invalid payload with a shortened tag (e.g. 1 byte) such that they would have a 1 in 256 chance of passing the MAC check. GCM tag forgeries can cause key leakage.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2018-10903?
CVE-2018-10903 has a severity rating of medium due to the potential for attackers to exploit the inadequate tag length enforcement.
How do I fix CVE-2018-10903?
To fix CVE-2018-10903, update python-cryptography to version 2.3 or later.
Which versions of python-cryptography are affected by CVE-2018-10903?
Versions of python-cryptography between 1.9.0 and 2.2 are affected by CVE-2018-10903.
What could an attacker achieve by exploiting CVE-2018-10903?
An attacker could potentially craft an invalid payload leading to security vulnerabilities due to improper input validation in the finalize_with_tag API.
Is CVE-2018-10903 related to specific operating systems?
Yes, CVE-2018-10903 affects installations of python-cryptography on various operating systems including Red Hat and Ubuntu.