Search for vulnerabilities
Vulnerability details: VCID-69da-bw9p-aaae
Vulnerability ID VCID-69da-bw9p-aaae
Aliases CVE-2018-10903
GHSA-fcf9-3qw3-gxmj
PYSEC-2018-52
Summary A flaw was found in python-cryptography versions between >=1.9.0 and <2.3. The finalize_with_tag API did not enforce a minimum tag length. If a user did not validate the input length prior to passing it to finalize_with_tag an attacker could craft an invalid payload with a shortened tag (e.g. 1 byte) such that they would have a 1 in 256 chance of passing the MAC check. GCM tag forgeries can cause key leakage.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-20 Improper Input Validation
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
generic_textual Medium http://people.canonical.com/~ubuntu-security/cve/2018/CVE-2018-10903.html
rhas Moderate https://access.redhat.com/errata/RHSA-2018:3600
cvssv3 7.5 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2018-10903.json
epss 0.00178 https://api.first.org/data/v1/epss?cve=CVE-2018-10903
epss 0.00178 https://api.first.org/data/v1/epss?cve=CVE-2018-10903
epss 0.00178 https://api.first.org/data/v1/epss?cve=CVE-2018-10903
epss 0.00178 https://api.first.org/data/v1/epss?cve=CVE-2018-10903
epss 0.00178 https://api.first.org/data/v1/epss?cve=CVE-2018-10903
epss 0.00178 https://api.first.org/data/v1/epss?cve=CVE-2018-10903
epss 0.00178 https://api.first.org/data/v1/epss?cve=CVE-2018-10903
epss 0.00178 https://api.first.org/data/v1/epss?cve=CVE-2018-10903
epss 0.00178 https://api.first.org/data/v1/epss?cve=CVE-2018-10903
epss 0.00178 https://api.first.org/data/v1/epss?cve=CVE-2018-10903
epss 0.00178 https://api.first.org/data/v1/epss?cve=CVE-2018-10903
epss 0.00178 https://api.first.org/data/v1/epss?cve=CVE-2018-10903
epss 0.00178 https://api.first.org/data/v1/epss?cve=CVE-2018-10903
epss 0.00178 https://api.first.org/data/v1/epss?cve=CVE-2018-10903
epss 0.00178 https://api.first.org/data/v1/epss?cve=CVE-2018-10903
epss 0.00178 https://api.first.org/data/v1/epss?cve=CVE-2018-10903
epss 0.00251 https://api.first.org/data/v1/epss?cve=CVE-2018-10903
epss 0.00251 https://api.first.org/data/v1/epss?cve=CVE-2018-10903
epss 0.00327 https://api.first.org/data/v1/epss?cve=CVE-2018-10903
epss 0.00327 https://api.first.org/data/v1/epss?cve=CVE-2018-10903
epss 0.00327 https://api.first.org/data/v1/epss?cve=CVE-2018-10903
epss 0.00327 https://api.first.org/data/v1/epss?cve=CVE-2018-10903
epss 0.00327 https://api.first.org/data/v1/epss?cve=CVE-2018-10903
epss 0.00327 https://api.first.org/data/v1/epss?cve=CVE-2018-10903
epss 0.00327 https://api.first.org/data/v1/epss?cve=CVE-2018-10903
epss 0.00327 https://api.first.org/data/v1/epss?cve=CVE-2018-10903
epss 0.00327 https://api.first.org/data/v1/epss?cve=CVE-2018-10903
epss 0.00327 https://api.first.org/data/v1/epss?cve=CVE-2018-10903
epss 0.00327 https://api.first.org/data/v1/epss?cve=CVE-2018-10903
epss 0.00327 https://api.first.org/data/v1/epss?cve=CVE-2018-10903
epss 0.00327 https://api.first.org/data/v1/epss?cve=CVE-2018-10903
epss 0.00327 https://api.first.org/data/v1/epss?cve=CVE-2018-10903
epss 0.00327 https://api.first.org/data/v1/epss?cve=CVE-2018-10903
epss 0.00327 https://api.first.org/data/v1/epss?cve=CVE-2018-10903
epss 0.00327 https://api.first.org/data/v1/epss?cve=CVE-2018-10903
epss 0.00327 https://api.first.org/data/v1/epss?cve=CVE-2018-10903
epss 0.00327 https://api.first.org/data/v1/epss?cve=CVE-2018-10903
epss 0.00327 https://api.first.org/data/v1/epss?cve=CVE-2018-10903
epss 0.00327 https://api.first.org/data/v1/epss?cve=CVE-2018-10903
epss 0.00327 https://api.first.org/data/v1/epss?cve=CVE-2018-10903
epss 0.00327 https://api.first.org/data/v1/epss?cve=CVE-2018-10903
epss 0.00327 https://api.first.org/data/v1/epss?cve=CVE-2018-10903
epss 0.00327 https://api.first.org/data/v1/epss?cve=CVE-2018-10903
epss 0.00327 https://api.first.org/data/v1/epss?cve=CVE-2018-10903
epss 0.00327 https://api.first.org/data/v1/epss?cve=CVE-2018-10903
epss 0.00327 https://api.first.org/data/v1/epss?cve=CVE-2018-10903
epss 0.00333 https://api.first.org/data/v1/epss?cve=CVE-2018-10903
epss 0.00333 https://api.first.org/data/v1/epss?cve=CVE-2018-10903
epss 0.00333 https://api.first.org/data/v1/epss?cve=CVE-2018-10903
epss 0.00333 https://api.first.org/data/v1/epss?cve=CVE-2018-10903
epss 0.00333 https://api.first.org/data/v1/epss?cve=CVE-2018-10903
epss 0.00333 https://api.first.org/data/v1/epss?cve=CVE-2018-10903
epss 0.00333 https://api.first.org/data/v1/epss?cve=CVE-2018-10903
epss 0.00333 https://api.first.org/data/v1/epss?cve=CVE-2018-10903
epss 0.00333 https://api.first.org/data/v1/epss?cve=CVE-2018-10903
epss 0.00333 https://api.first.org/data/v1/epss?cve=CVE-2018-10903
epss 0.00333 https://api.first.org/data/v1/epss?cve=CVE-2018-10903
epss 0.00333 https://api.first.org/data/v1/epss?cve=CVE-2018-10903
epss 0.00333 https://api.first.org/data/v1/epss?cve=CVE-2018-10903
epss 0.00333 https://api.first.org/data/v1/epss?cve=CVE-2018-10903
epss 0.00333 https://api.first.org/data/v1/epss?cve=CVE-2018-10903
epss 0.00333 https://api.first.org/data/v1/epss?cve=CVE-2018-10903
epss 0.00333 https://api.first.org/data/v1/epss?cve=CVE-2018-10903
epss 0.00333 https://api.first.org/data/v1/epss?cve=CVE-2018-10903
epss 0.00333 https://api.first.org/data/v1/epss?cve=CVE-2018-10903
epss 0.00333 https://api.first.org/data/v1/epss?cve=CVE-2018-10903
epss 0.00333 https://api.first.org/data/v1/epss?cve=CVE-2018-10903
epss 0.00333 https://api.first.org/data/v1/epss?cve=CVE-2018-10903
epss 0.00333 https://api.first.org/data/v1/epss?cve=CVE-2018-10903
epss 0.00333 https://api.first.org/data/v1/epss?cve=CVE-2018-10903
epss 0.00333 https://api.first.org/data/v1/epss?cve=CVE-2018-10903
epss 0.00333 https://api.first.org/data/v1/epss?cve=CVE-2018-10903
epss 0.00333 https://api.first.org/data/v1/epss?cve=CVE-2018-10903
epss 0.00333 https://api.first.org/data/v1/epss?cve=CVE-2018-10903
epss 0.00333 https://api.first.org/data/v1/epss?cve=CVE-2018-10903
epss 0.00333 https://api.first.org/data/v1/epss?cve=CVE-2018-10903
epss 0.00333 https://api.first.org/data/v1/epss?cve=CVE-2018-10903
epss 0.00333 https://api.first.org/data/v1/epss?cve=CVE-2018-10903
epss 0.00333 https://api.first.org/data/v1/epss?cve=CVE-2018-10903
epss 0.00333 https://api.first.org/data/v1/epss?cve=CVE-2018-10903
epss 0.00333 https://api.first.org/data/v1/epss?cve=CVE-2018-10903
epss 0.00333 https://api.first.org/data/v1/epss?cve=CVE-2018-10903
epss 0.00333 https://api.first.org/data/v1/epss?cve=CVE-2018-10903
epss 0.00333 https://api.first.org/data/v1/epss?cve=CVE-2018-10903
epss 0.02476 https://api.first.org/data/v1/epss?cve=CVE-2018-10903
rhbs medium https://bugzilla.redhat.com/show_bug.cgi?id=1602931
cvssv3.1 7.5 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10903
generic_textual HIGH https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10903
generic_textual Medium https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10903
cvssv3 5.3 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-fcf9-3qw3-gxmj
cvssv3.1 7.5 https://github.com/pyca/cryptography
generic_textual HIGH https://github.com/pyca/cryptography
cvssv3.1 7.5 https://github.com/pyca/cryptography/commit/d4378e42937b56f473ddade2667f919ce32208cb
generic_textual HIGH https://github.com/pyca/cryptography/commit/d4378e42937b56f473ddade2667f919ce32208cb
cvssv3.1 7.5 https://github.com/pyca/cryptography/pull/4342
generic_textual HIGH https://github.com/pyca/cryptography/pull/4342
cvssv3.1 7.5 https://github.com/pypa/advisory-database/tree/main/vulns/cryptography/PYSEC-2018-52.yaml
generic_textual HIGH https://github.com/pypa/advisory-database/tree/main/vulns/cryptography/PYSEC-2018-52.yaml
cvssv2 5.0 https://nvd.nist.gov/vuln/detail/CVE-2018-10903
cvssv3 7.5 https://nvd.nist.gov/vuln/detail/CVE-2018-10903
generic_textual Medium https://ubuntu.com/security/notices/USN-3720-1
cvssv3.1 7.5 https://usn.ubuntu.com/3720-1
generic_textual HIGH https://usn.ubuntu.com/3720-1
Reference id Reference type URL
http://cwe.mitre.org/data/definitions/20.html
http://people.canonical.com/~ubuntu-security/cve/2018/CVE-2018-10903.html
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2018-10903.json
https://api.first.org/data/v1/epss?cve=CVE-2018-10903
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10903
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10903
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://github.com/pyca/cryptography
https://github.com/pyca/cryptography/commit/d4378e42937b56f473ddade2667f919ce32208cb
https://github.com/pyca/cryptography/pull/4342
https://github.com/pyca/cryptography/pull/4342/commits/688e0f673bfbf43fa898994326c6877f00ab19ef
https://github.com/pypa/advisory-database/tree/main/vulns/cryptography/PYSEC-2018-52.yaml
https://ubuntu.com/security/notices/USN-3720-1
https://usn.ubuntu.com/3720-1
https://usn.ubuntu.com/3720-1/
1602931 https://bugzilla.redhat.com/show_bug.cgi?id=1602931
904072 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=904072
cpe:2.3:a:cryptography:python-cryptography:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:cryptography:python-cryptography:*:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openstack:13:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:redhat:openstack:13:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
CVE-2018-10903 https://nvd.nist.gov/vuln/detail/CVE-2018-10903
GHSA-fcf9-3qw3-gxmj https://github.com/advisories/GHSA-fcf9-3qw3-gxmj
RHSA-2018:3600 https://access.redhat.com/errata/RHSA-2018:3600
No exploits are available.
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2018-10903.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10903
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/pyca/cryptography
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/pyca/cryptography/commit/d4378e42937b56f473ddade2667f919ce32208cb
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/pyca/cryptography/pull/4342
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/pypa/advisory-database/tree/main/vulns/cryptography/PYSEC-2018-52.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2018-10903
Exploitability (E) Access Vector (AV) Access Complexity (AC) Authentication (Au) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

high

functional

unproven

proof_of_concept

not_defined

local

adjacent_network

network

high

medium

low

multiple

single

none

none

partial

complete

none

partial

complete

none

partial

complete
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2018-10903
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://usn.ubuntu.com/3720-1
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.55753
EPSS Score 0.00178
Published At Nov. 1, 2024, midnight
Date Actor Action Source VulnerableCode Version
There are no relevant records.