CVE-2018-10903 : Security Advisory and Response

An issue has been discovered in python-cryptography versions 1.9.0 and later but prior to 2.3. The problem arises from the finalize_with_tag API, which does not enforce a minimum length for the tag. Consequently, if a user fails to validate the input length before submitting it to finalize_with_tag, an attacker can create a malicious payload with a shortened tag (e.g. 1 byte), resulting in a 1 in 256 probability of successfully passing the MAC check. GCM tag forgeries can lead to the disclosure of sensitive information such as cryptographic keys.

Understanding CVE-2018-10903

This section provides insights into the nature and impact of the CVE-2018-10903 vulnerability.

What is CVE-2018-10903?

CVE-2018-10903 is a vulnerability found in python-cryptography versions between 1.9.0 and 2.3. It stems from the lack of enforcement of a minimum tag length in the finalize_with_tag API.

The Impact of CVE-2018-10903

The vulnerability poses a high severity risk with a CVSS base score of 7.5. It can result in high confidentiality impact, potentially leading to the disclosure of sensitive information like cryptographic keys.

Technical Details of CVE-2018-10903

This section delves into the technical aspects of CVE-2018-10903.

Vulnerability Description

The vulnerability arises from the finalize_with_tag API in python-cryptography, allowing attackers to craft malicious payloads with shortened tags, bypassing MAC checks.

Affected Systems and Versions

Product: python-cryptography
Vendor: [UNKNOWN]
Versions Affected: 2.3

Exploitation Mechanism

The attacker can exploit the lack of tag length enforcement in the finalize_with_tag API to create payloads with shortened tags, increasing the probability of passing MAC checks.

Mitigation and Prevention

Learn how to mitigate and prevent the CVE-2018-10903 vulnerability.

Immediate Steps to Take

Update python-cryptography to version 2.3 or later to mitigate the vulnerability.
Validate input length before passing it to finalize_with_tag to prevent crafted payloads.

Long-Term Security Practices

Regularly update software and libraries to the latest versions to address known vulnerabilities.
Implement secure coding practices to validate all inputs and enforce security controls.

Patching and Updates

Stay informed about security advisories from vendors like Red Hat and Ubuntu.
Apply patches and updates promptly to ensure system security.