View at Official suse advisory, NVD, CVE.org · CVE detail
Freshness: upstream tracker timestamp is available; use API updated time as primary recency signal.
CVE-2018-10903 severity important: SUSE including 298 source package names (1.1.0-build4.19.12:python3-cryptography-2.9.2-150200.13.1, 1.10.1.16.4.5.328:python3-cryptography-2.9.2-150200.13.1, …), 529 product×package rows across 100 product lines (Container ses/7.1/cephcsi/cephcsi, Container ses/7.1/rook/ceph, … (100 product lines)): Fixed 310, Known Affected 219.
A flaw was found in python-cryptography versions between >=1.9.0 and <2.3. The finalize_with_tag API did not enforce a minimum tag length. If a user did not validate the input length prior to passing it to finalize_with_tag an attacker could craft an invalid payload with a shortened tag (e.g. 1 byte) such that they would have a 1 in 256 chance of passing the MAC check. GCM tag forgeries can cause key leakage.