CVE-2018-10903

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

A flaw was found in python-cryptography versions between >=1.9.0 and <2.3. The finalize_with_tag API did not enforce a minimum tag length. If a user did not validate the input length prior to passing it to finalize_with_tag an attacker could craft an invalid payload with a shortened tag (e.g. 1 byte) such that they would have a 1 in 256 chance of passing the MAC check. GCM tag forgeries can cause key leakage.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
[UNKNOWN]	python-cryptography	2.3

References

https://access.redhat.com/errata/RHSA-2018:3600
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10903Issue Tracking, Patch, Third Party Advisory
https://github.com/pyca/cryptography/pull/4342/commits/688e0f673bfbf43fa898994326c6877f00ab19efPatch, Third Party Advisory
https://usn.ubuntu.com/3720-1/Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:3600
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10903Issue Tracking, Patch, Third Party Advisory
https://github.com/pyca/cryptography/pull/4342/commits/688e0f673bfbf43fa898994326c6877f00ab19efPatch, Third Party Advisory
https://usn.ubuntu.com/3720-1/Third Party Advisory

Timeline

Published: Jul 30, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-109048.8It was found that glusterfs server does not properly sanitize file paths in the "trusted.io-stats-dump" extended attribute which is used by CVE-2018-109057.8CloudForms Management Engine (cfme) is vulnerable to an improper security setting in the dRuby component of CloudForms. An attacker with acc CVE-2018-109067.8In fuse before versions 2.9.8 and 3.x before 3.2.5, fusermount is vulnerable to a restriction bypass when SELinux is active. This allows non CVE-2018-109078.8It was found that glusterfs server is vulnerable to multiple stack based buffer overflows due to functions in server-rpc-fopc.c allocating f CVE-2018-109086.3It was found that vdsm before version 4.20.37 invokes qemu-img on untrusted inputs without limiting resources. By uploading a specially craf CVE-2018-10915.5In the flush_tmregs_to_thread function in arch/powerpc/kernel/ptrace.c in the Linux kernel before 4.13.5, a guest kernel crash can be trigge CVE-2018-109103.3A bug in Bluez may allow for the Bluetooth Discoverable state being set to on when no Bluetooth agent is registered with the system. This si CVE-2018-109117.5A flaw was found in the way dic_unserialize function of glusterfs does not handle negative key length values. An attacker could use this fla CVE-2018-109124.9keycloak before version 4.0.0.final is vulnerable to a infinite loop in session replacement. A Keycloak cluster with multiple nodes could mi CVE-2018-109136.5An information disclosure vulnerability was discovered in glusterfs server. An attacker could issue a xattr request via glusterfs FUSE to de CVE-2018-109146.5It was found that an attacker could issue a xattr request via glusterfs FUSE to cause gluster brick process to crash which will result in a CVE-2018-109157.5A vulnerability was found in libpq, the default PostgreSQL client library where libpq failed to properly reset its internal state between co