PT-2018-10171 · Python+2 · Python-Cryptography+2

Reaperhulk · Published 2018-07-20 · Updated 2022-11-17 · CVE-2018-10903

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions python-cryptography versions 1.9.0 through 2.3

Description A flaw was found in the finalize with tag API, which did not enforce a minimum tag length. This allows an attacker to craft an invalid payload with a shortened tag, potentially leading to GCM tag forgeries and key leakage. If a user does not validate the input length prior to passing it to finalize with tag, an attacker could have a chance of passing the MAC check.

Recommendations For python-cryptography versions 1.9.0 through 2.3, consider validating the input length prior to passing it to finalize with tag to prevent potential GCM tag forgeries and key leakage. As a temporary workaround, ensure that all tags passed to finalize with tag have a validated minimum length to minimize the risk of exploitation.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2018-10903

GHSA-FCF9-3QW3-GXMJ

MGASA-2018-0429

OPENSUSE-SU-2018_3445-1

OPENSUSE-SU-2022_4044-1

PYSEC-2018-52

RHSA-2018:3600

SUSE-SU-2018:3392-1

SUSE-SU-2018:3553-1

SUSE-SU-2018_3392-1

SUSE-SU-2020:0790-1

SUSE-SU-2020:0792-1

SUSE-SU-2020_0790-1

SUSE-SU-2020_0792-1

SUSE-SU-2022:4044-1

SUSE-SU-2022_4044-1

USN-3720-1

Affected Products

Suse

Ubuntu

Python-Cryptography

References · 44

• https://github.com/pyca/cryptography/pull/4342/commits/688e0f673bfbf43fa898994326c6877f00ab19ef · Patch
• https://cve.org/CVERecord?id=CVE-2018-10903 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2018-10903 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2020:0790-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3720-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2018-10903 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2018:3553-1 · Vendor Advisory
• https://usn.ubuntu.com/3720-1 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10903 · Patch
• https://osv.dev/vulnerability/PYSEC-2018-52 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2018-0429 · Vendor Advisory
• https://osv.dev/vulnerability/USN-3720-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2018:3392-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:4044-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-10903 · Vendor Advisory