Lucene search

K
githubGitHub Advisory DatabaseGHSA-87MP-XC4X-X8RH
HistoryMay 15, 2024 - 5:47 p.m.

asymmetricrypt/asymmetricrypt Padding Oracle Vulnerability in RSA Encryption

2024-05-1517:47:31
CWE-327
GitHub Advisory Database
github.com
3
asymmetric crypt
padding oracle
rsa encryption
bleichenbacher's attack
wrong padding
openssl pkcs1 padding
patch
vulnerability

7 High

AI Score

Confidence

Low

The encryption and decryption process were vulnerable against the Bleichenbacher’s attack, which is a padding oracle vulnerability disclosed in the 98’.
The issue was about the wrong padding utilized, which allowed to retrieve the encrypted content.
The OPENSSL_PKCS1_PADDING version, aka PKCS v1.5 was vulnerable (is the one set by default when using openssl_* methods), while the PKCS v2.0 isn’t anymore (it’s also called OAEP).

A fix for this vulnerability was merged at https://github.com/Cosmicist/AsymmetriCrypt/pull/5/commits/a0318cfc5022f2a7715322dba3ff91d475ace7c6.

CPENameOperatorVersion
asymmetricrypt/asymmetricryptle0.3.0

7 High

AI Score

Confidence

Low