CVE-2018-10903
Fixed in a distro release EPSS 3%CVSS 7.5
A flaw was found in python-cryptography versions between >=1.9.0 and <2.3. The finalize_with_tag API did not enforce a minimum tag length. If a user did not validate the input length prior to passing it to finalize_with_tag an attacker could craft an invalid payload with a shortened tag (e.g. 1 byte) such that they would have a 1 in 256 chance of passing the MAC check. GCM tag forgeries can cause key leakage.
Products: python-cryptography, redhat openstack, canonical ubuntu_linux
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | cryptography | 2.3 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | python-cryptography | 2.3-1 |
| Debian 13 | python-cryptography | 2.3-1 |
| Debian 14 | python-cryptography | 2.3-1 |
| Red Hat openstack 13 | python-cryptography | 0:2.1.4-3.el7ost |
| Red Hat openstack 13 | python-cryptography-debuginfo | 0:2.1.4-3.el7ost |
| Red Hat openstack 13 | python2-cryptography | 0:2.1.4-3.el7ost |
| SUSE Enterprise Storage 5 | python-cffi | 1.11.2-5.11.1 |
| SUSE Enterprise Storage 5 | python-cryptography | 2.1.4-7.28.2 |
| SUSE Enterprise Storage 5 | python-xattr | 0.7.5-6.3.2 |
| SUSE Enterprise Storage 7 | python-cryptography | 2.9.2-150200.13.1 |
| SUSE HPE Helion OpenStack 8 | python-cffi | 1.11.2-5.11.1 |
| SUSE HPE Helion OpenStack 8 | python-cryptography | 2.1.4-7.28.2 |
| SUSE HPE Helion OpenStack 8 | python-cryptography | 2.0.3-3.3.1 |
| SUSE HPE Helion OpenStack 8 | python-xattr | 0.7.5-6.3.2 |
| SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS | python-cryptography | 2.9.2-150200.13.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS | python-cryptography | 2.9.2-150200.13.1 |
| SUSE Linux Enterprise Micro 5.1 | python-cryptography | 2.9.2-150200.13.1 |
| SUSE Linux Enterprise Micro 5.2 | python-cryptography | 2.9.2-150200.13.1 |
| SUSE Linux Enterprise Module for Basesystem 15 | python-cryptography | 2.1.4-4.3.1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP3 | python-cryptography | 2.9.2-150200.13.1 |
| SUSE Linux Enterprise Module for Python 2 15 SP3 | python-cryptography | 2.9.2-150200.13.1 |
| SUSE Linux Enterprise Server 12 SP1-LTSS | python-cffi | 1.11.2-2.19.2 |
| SUSE Linux Enterprise Server 12 SP1-LTSS | python-cryptography | 2.1.4-3.15.5 |
| SUSE Linux Enterprise Server 12 SP1-LTSS | python-xattr | 0.7.5-3.2.1 |
| SUSE Linux Enterprise Server 12 SP2-BCL | python-cffi | 1.11.2-5.11.1 |
| SUSE Linux Enterprise Server 12 SP2-BCL | python-cryptography | 2.1.4-7.28.2 |
| SUSE Linux Enterprise Server 12 SP2-BCL | python-xattr | 0.7.5-6.3.2 |
| SUSE Linux Enterprise Server 12 SP2-LTSS | python-cffi | 1.11.2-5.11.1 |
| SUSE Linux Enterprise Server 12 SP2-LTSS | python-cryptography | 2.1.4-7.28.2 |
| SUSE Linux Enterprise Server 12 SP2-LTSS | python-xattr | 0.7.5-6.3.2 |
| SUSE Linux Enterprise Server 12 SP3-BCL | python-cffi | 1.11.2-5.11.1 |
| SUSE Linux Enterprise Server 12 SP3-BCL | python-cryptography | 2.1.4-7.28.2 |
| SUSE Linux Enterprise Server 12 SP3-BCL | python-xattr | 0.7.5-6.3.2 |
| SUSE Linux Enterprise Server 12 SP3-LTSS | python-cffi | 1.11.2-5.11.1 |
| SUSE Linux Enterprise Server 12 SP3-LTSS | python-cryptography | 2.1.4-7.28.2 |
| SUSE Linux Enterprise Server 12 SP3-LTSS | python-xattr | 0.7.5-6.3.2 |
| SUSE Linux Enterprise Server 12 SP4 | python-cffi | 1.11.2-5.11.1 |
| SUSE Linux Enterprise Server 12 SP4 | python-cryptography | 2.1.4-7.28.2 |
| SUSE Linux Enterprise Server 12 SP4 | python-xattr | 0.7.5-6.3.2 |
| SUSE Linux Enterprise Server 12 SP5 | python-cffi | 1.11.2-5.11.1 |
| SUSE Linux Enterprise Server 12 SP5 | python-cryptography | 2.1.4-7.28.2 |
| SUSE Linux Enterprise Server 12 SP5 | python-xattr | 0.7.5-6.3.2 |
| SUSE Linux Enterprise Server 15 SP2-BCL | python-cryptography | 2.9.2-150200.13.1 |
| SUSE Linux Enterprise Server 15 SP2-LTSS | python-cryptography | 2.9.2-150200.13.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP1 | python-cffi | 1.11.2-2.19.2 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP1 | python-cryptography | 2.1.4-3.15.5 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP1 | python-xattr | 0.7.5-3.2.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP2 | python-cffi | 1.11.2-5.11.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP2 | python-cryptography | 2.1.4-7.28.2 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP2 | python-xattr | 0.7.5-6.3.2 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP3 | python-cffi | 1.11.2-5.11.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP3 | python-cryptography | 2.1.4-7.28.2 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP3 | python-xattr | 0.7.5-6.3.2 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP4 | python-cffi | 1.11.2-5.11.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP4 | python-cryptography | 2.1.4-7.28.2 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP4 | python-xattr | 0.7.5-6.3.2 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP5 | python-cffi | 1.11.2-5.11.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP5 | python-cryptography | 2.1.4-7.28.2 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP5 | python-xattr | 0.7.5-6.3.2 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP2 | python-cryptography | 2.9.2-150200.13.1 |
| SUSE Manager Proxy 4.1 | python-cryptography | 2.9.2-150200.13.1 |
| SUSE Manager Retail Branch Server 4.1 | python-cryptography | 2.9.2-150200.13.1 |
| SUSE Manager Server 4.1 | python-cryptography | 2.9.2-150200.13.1 |
| SUSE OpenStack Cloud 6-LTSS | python-cryptography | 2.1.4-3.15.5 |
| SUSE OpenStack Cloud 7 | python-cffi | 1.11.2-5.11.1 |
| SUSE OpenStack Cloud 7 | python-cryptography | 2.1.4-7.28.2 |
| SUSE OpenStack Cloud 7 | python-xattr | 0.7.5-6.3.2 |
| SUSE OpenStack Cloud 8 | python-cffi | 1.11.2-5.11.1 |
| SUSE OpenStack Cloud 8 | python-cryptography | 2.0.3-3.3.1 |
| SUSE OpenStack Cloud 8 | python-cryptography | 2.1.4-7.28.2 |
| SUSE OpenStack Cloud 8 | python-xattr | 0.7.5-6.3.2 |
| SUSE OpenStack Cloud Crowbar 8 | python-cffi | 1.11.2-5.11.1 |
| SUSE OpenStack Cloud Crowbar 8 | python-cryptography | 2.0.3-3.3.1 |
| SUSE OpenStack Cloud Crowbar 8 | python-cryptography | 2.1.4-7.28.2 |
| SUSE OpenStack Cloud Crowbar 8 | python-xattr | 0.7.5-6.3.2 |
| Ubuntu 18.04 LTS | python-cryptography | 2.1.4-1ubuntu1.2 |
| openSUSE Leap 15.3 | python-cryptography | 2.9.2-150200.13.1 |
| openSUSE Leap 15.3 | python-cryptography-vectors | 2.9.2-150200.3.3.1 |
| openSUSE Leap Micro 5.2 | python-cryptography | 2.9.2-150200.13.1 |