Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:pypi/cryptography@1.9.0
purl pkg:pypi/cryptography@1.9.0
Tags Ghost
Next non-vulnerable version 46.0.5
Latest non-vulnerable version 46.0.7
Risk 4.0
Vulnerabilities affecting this package (1)
Vulnerability Summary Fixed by
VCID-4nw9-zhuy-y7cz
Aliases:
CVE-2018-10903
GHSA-fcf9-3qw3-gxmj
PYSEC-2018-52
A flaw was found in python-cryptography versions between >=1.9.0 and <2.3. The finalize_with_tag API did not enforce a minimum tag length. If a user did not validate the input length prior to passing it to finalize_with_tag an attacker could craft an invalid payload with a shortened tag (e.g. 1 byte) such that they would have a 1 in 256 chance of passing the MAC check. GCM tag forgeries can cause key leakage.
2.3
Affected by 8 other vulnerabilities.
Vulnerabilities fixed by this package (0)
Vulnerability Summary Aliases
This package is not known to fix vulnerabilities.

Date Actor Action Vulnerability Source VulnerableCode Version
2026-04-01T15:56:35.369933+00:00 GHSA Importer Affected by VCID-4nw9-zhuy-y7cz https://github.com/advisories/GHSA-fcf9-3qw3-gxmj 38.0.0
2026-04-01T12:47:53.703883+00:00 GitLab Importer Affected by VCID-4nw9-zhuy-y7cz https://gitlab.com/gitlab-org/advisories-community/-/blob/main/pypi/cryptography/CVE-2018-10903.yml 38.0.0