CVE:CVE-2018-10903
CNNVD:CNNVD-201807-1978
python-cryptography是一个基于Python语言的加密标准库。
python-cryptography 1.9.0版本至2.3版本（不包括2.3版本）存在安全漏洞，该漏洞源于finalize_with_tag API没有遵守标签的最小长度值的设置。攻击者可通过构造带有较小标签的无效载荷利用该漏洞绕过MAC，泄露密钥。
solution:Upgrade cryptography python-cryptography to a higher version than 2.3,and avoid the version [1.9.0,2.3); Upgrade redhat openstack to a higher version than 13,and avoid the version 13; Upgrade canonical ubuntu_linux to a higher version than 18.04,and avoid the version 18.04