Search for vulnerabilities
Vulnerability details: VCID-9zn2-7pgs-f7eg
Vulnerability ID VCID-9zn2-7pgs-f7eg
Aliases CVE-2018-10903
GHSA-fcf9-3qw3-gxmj
PYSEC-2018-52
Summary A flaw was found in python-cryptography versions between >=1.9.0 and <2.3. The finalize_with_tag API did not enforce a minimum tag length. If a user did not validate the input length prior to passing it to finalize_with_tag an attacker could craft an invalid payload with a shortened tag (e.g. 1 byte) such that they would have a 1 in 256 chance of passing the MAC check. GCM tag forgeries can cause key leakage.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-20 Improper Input Validation
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3.1 7.5 https://access.redhat.com/errata/RHSA-2018:3600
generic_textual HIGH https://access.redhat.com/errata/RHSA-2018:3600
cvssv3 7.5 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2018-10903.json
epss 0.00251 https://api.first.org/data/v1/epss?cve=CVE-2018-10903
epss 0.00251 https://api.first.org/data/v1/epss?cve=CVE-2018-10903
epss 0.00251 https://api.first.org/data/v1/epss?cve=CVE-2018-10903
epss 0.00251 https://api.first.org/data/v1/epss?cve=CVE-2018-10903
epss 0.00251 https://api.first.org/data/v1/epss?cve=CVE-2018-10903
epss 0.00251 https://api.first.org/data/v1/epss?cve=CVE-2018-10903
epss 0.00251 https://api.first.org/data/v1/epss?cve=CVE-2018-10903
epss 0.00251 https://api.first.org/data/v1/epss?cve=CVE-2018-10903
epss 0.00251 https://api.first.org/data/v1/epss?cve=CVE-2018-10903
epss 0.00251 https://api.first.org/data/v1/epss?cve=CVE-2018-10903
epss 0.00251 https://api.first.org/data/v1/epss?cve=CVE-2018-10903
epss 0.00251 https://api.first.org/data/v1/epss?cve=CVE-2018-10903
epss 0.00251 https://api.first.org/data/v1/epss?cve=CVE-2018-10903
epss 0.00251 https://api.first.org/data/v1/epss?cve=CVE-2018-10903
epss 0.00251 https://api.first.org/data/v1/epss?cve=CVE-2018-10903
epss 0.00251 https://api.first.org/data/v1/epss?cve=CVE-2018-10903
epss 0.00251 https://api.first.org/data/v1/epss?cve=CVE-2018-10903
epss 0.00251 https://api.first.org/data/v1/epss?cve=CVE-2018-10903
epss 0.00403 https://api.first.org/data/v1/epss?cve=CVE-2018-10903
epss 0.00403 https://api.first.org/data/v1/epss?cve=CVE-2018-10903
epss 0.00403 https://api.first.org/data/v1/epss?cve=CVE-2018-10903
epss 0.00403 https://api.first.org/data/v1/epss?cve=CVE-2018-10903
epss 0.00403 https://api.first.org/data/v1/epss?cve=CVE-2018-10903
epss 0.00403 https://api.first.org/data/v1/epss?cve=CVE-2018-10903
epss 0.00403 https://api.first.org/data/v1/epss?cve=CVE-2018-10903
epss 0.00403 https://api.first.org/data/v1/epss?cve=CVE-2018-10903
epss 0.00403 https://api.first.org/data/v1/epss?cve=CVE-2018-10903
cvssv3.1 7.5 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10903
generic_textual HIGH https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10903
cvssv3 5.3 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3.1 7.5 https://github.com/advisories/GHSA-fcf9-3qw3-gxmj
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-fcf9-3qw3-gxmj
generic_textual HIGH https://github.com/advisories/GHSA-fcf9-3qw3-gxmj
cvssv3.1 7.5 https://github.com/pyca/cryptography
generic_textual HIGH https://github.com/pyca/cryptography
cvssv3.1 7.5 https://github.com/pyca/cryptography/commit/d4378e42937b56f473ddade2667f919ce32208cb
generic_textual HIGH https://github.com/pyca/cryptography/commit/d4378e42937b56f473ddade2667f919ce32208cb
cvssv3.1 7.5 https://github.com/pyca/cryptography/pull/4342
generic_textual HIGH https://github.com/pyca/cryptography/pull/4342
cvssv3.1 7.5 https://github.com/pypa/advisory-database/tree/main/vulns/cryptography/PYSEC-2018-52.yaml
generic_textual HIGH https://github.com/pypa/advisory-database/tree/main/vulns/cryptography/PYSEC-2018-52.yaml
cvssv2 5.0 https://nvd.nist.gov/vuln/detail/CVE-2018-10903
cvssv3 7.5 https://nvd.nist.gov/vuln/detail/CVE-2018-10903
cvssv3.1 7.5 https://nvd.nist.gov/vuln/detail/CVE-2018-10903
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2018-10903
cvssv3.1 7.5 https://usn.ubuntu.com/3720-1
generic_textual HIGH https://usn.ubuntu.com/3720-1
Reference id Reference type URL
https://access.redhat.com/errata/RHSA-2018:3600
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2018-10903.json
https://api.first.org/data/v1/epss?cve=CVE-2018-10903
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10903
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10903
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://github.com/advisories/GHSA-fcf9-3qw3-gxmj
https://github.com/pyca/cryptography
https://github.com/pyca/cryptography/commit/d4378e42937b56f473ddade2667f919ce32208cb
https://github.com/pyca/cryptography/pull/4342
https://github.com/pyca/cryptography/pull/4342/commits/688e0f673bfbf43fa898994326c6877f00ab19ef
https://github.com/pypa/advisory-database/tree/main/vulns/cryptography/PYSEC-2018-52.yaml
https://nvd.nist.gov/vuln/detail/CVE-2018-10903
https://usn.ubuntu.com/3720-1
https://usn.ubuntu.com/3720-1/
1602931 https://bugzilla.redhat.com/show_bug.cgi?id=1602931
904072 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=904072
cpe:2.3:a:cryptography:python-cryptography:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:cryptography:python-cryptography:*:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openstack:13:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:redhat:openstack:13:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
No exploits are available.
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://access.redhat.com/errata/RHSA-2018:3600
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2018-10903.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10903
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/advisories/GHSA-fcf9-3qw3-gxmj
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/pyca/cryptography
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/pyca/cryptography/commit/d4378e42937b56f473ddade2667f919ce32208cb
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/pyca/cryptography/pull/4342
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/pypa/advisory-database/tree/main/vulns/cryptography/PYSEC-2018-52.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2018-10903
Exploitability (E) Access Vector (AV) Access Complexity (AC) Authentication (Au) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

high

functional

unproven

proof_of_concept

not_defined

local

adjacent_network

network

high

medium

low

multiple

single

none

none

partial

complete

none

partial

complete

none

partial

complete
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2018-10903
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2018-10903
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://usn.ubuntu.com/3720-1
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.48407
EPSS Score 0.00251
Published At July 30, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-07-31T08:07:03.575384+00:00 Pypa Importer Import https://github.com/pypa/advisory-database/blob/main/vulns/cryptography/PYSEC-2018-52.yaml 37.0.0