CVE-2018-10903

Flaw: Insecure GCM Tag Length Check (python-cryptography)

• CVSS 7.5
• CWE-20 Improper Input Validation
• Cryptographic
• Remote

A flaw was found in python-cryptography versions between >=1.9.0 and <2.3. The finalize_with_tag API did not enforce a minimum tag length. If a user did not validate the input length prior to passing it to finalize_with_tag an attacker could craft an invalid payload with a shortened tag (e.g. 1 byte) such that they would have a 1 in 256 chance of passing the MAC check. GCM tag forgeries can cause key leakage.

CVE

CVE-2018-10903

CWE

CWE-20 Improper Input Validation

CVSS base score

7.5

Published

2018-07-30

OWASP

A02 Cryptographic Failures

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Cryptographic

Subcategory

Cryptographic Implementation Error

Accessibility scope

Remote

Impact

Information Disclosure

Fixed by upgrading

Yes

Solution

Update python-cryptography to version 2.3.0 or higher.

from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes

def finalize_with_tag(key, iv, ciphertext, tag):
    
    cipher = Cipher(algorithms.AES(key), modes.GCM(iv, tag))
    decryptor = cipher.decryptor()
    
    plaintext = decryptor.update(ciphertext) + decryptor.finalize()
    return plaintext

from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes
from cryptography.hazmat.backends import default_backend
from cryptography.exceptions import InvalidSignature

def finalize_with_tag(key, iv, ciphertext, tag):

    if len(tag) != 16:
        raise ValueError("Invalid tag length. Tag must be 16 bytes.")

    cipher = Cipher(algorithms.AES(key), modes.GCM(iv, tag), backend=default_backend())
    decryptor = cipher.decryptor()
    
    try:
        plaintext = decryptor.update(ciphertext) + decryptor.finalize()
        return plaintext
    except InvalidSignature:
        raise ValueError("Invalid MAC. Decryption failed.")

@misc{vaitp:cve201810903,
  title        = {{Flaw: Insecure GCM Tag Length Check (python-cryptography)}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2018},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2018-10903},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2018-10903/}}
}