GitHub Advisoryadvisory · Packagist

GHSA-87mp-xc4x-x8rh asymmetricrypt/asymmetricrypt Padding Oracle Vulnerability in RSA Encryption

MEDIUM Published 2024-05-15 Modified 2024-05-15 Official page ↗
Ecosystem
Packagist
Packages
asymmetricrypt/asymmetricrypt
Severity
Moderate
Weaknesses
CWE-327
Reviewed
2024-05-15

Affected packages

• Packagist asymmetricrypt/asymmetricrypt: <= 0.3.0 (no fix yet)

Description

The encryption and decryption process were vulnerable against the Bleichenbacher's attack, which is a padding oracle vulnerability disclosed in the 98'. The issue was about the wrong padding utilized, which allowed to retrieve the encrypted content. The OPENSSL_PKCS1_PADDING version, aka PKCS v1.5 was vulnerable (is the one set by default when using openssl_* methods), while the PKCS v2.0 isn't anymore (it's also called OAEP). A fix for this vulnerability was merged at https://github.com/Cosmicist/AsymmetriCrypt/pull/5/commits/a0318cfc5022f2a7715322dba3ff91d475ace7c6.

Related

Weakness · CWE (1)

  • CWE-327 Use of a Broken or Risky Cryptographic Algorithm weakness

References