False positive for CVE-2018-10903 : cryptography == 2.3 about safety-db HOT 5 CLOSED

         "cryptography":[
            "<1.5.3",
            "<0.9.1",
            "<1.0.2",
            ">=1.9.0",
            "<2.3"
         ],

         "cryptography":[
            "<1.5.3",
            "<0.9.1",
            "<1.0.2",
            ">=1.9.0,<2.3"
         ],

╞════════════════════════════╤═══════════╤══════════════════════════╤══════════╡
│ package                    │ installed │ affected                 │ ID       │
╞════════════════════════════╧═══════════╧══════════════════════════╧══════════╡
│ cryptography               │ 1.8.2     │ <=2.2.2                  │ 36351    │
╞══════════════════════════════════════════════════════════════════════════════╡
│ python-cryptography versions >=1.9.0 and <2.3 did not enforce a minimum tag  │
│ length for finalize_with_tag API. If a user did not validate the input lengt │
│ h prior to passing it to finalize_with_tag an attacker could craft an invali │
│ d payload with a shortened tag (e.g. 1 byte) such that they would have a 1 i │
│ n 256 chance of passing the MAC check. GCM tag forgeries can cause key leaka │
│ ge.                                                                          │
╘══════════════════════════════════════════════════════════════════════════════╛