GHSA-87mp-xc4x-x8rh
GHSA-87mp-xc4x-x8rh · asymmetricrypt/asymmetricrypt Padding Oracle Vulnerability in RSA Encryption
Здесь приведены факты из открытых источников об уязвимостях. Перед обновлением ознакомьтесь с исходным сообщением.
The encryption and decryption process were vulnerable against the Bleichenbacher's attack, which is a padding oracle vulnerability disclosed in the 98'. The issue was about the wrong padding utilized, which allowed to retrieve the encrypted content. The OPENSSL_PKCS1_PADDING version, aka PKCS v1.5 was vulnerable (is the one set by default when using openssl_* methods), while the PKCS v2.0 isn't anymore (it's also called OAEP). A fix for this vulnerability was merged at https://github.com/Cosmicist/AsymmetriCrypt/pull/5/commits/a0318cfc5022f2a7715322dba3ff91d475ace7c6.
- Опубликовано
- Обновлено
Стек: php
Затронутые продукты и версии
asymmetricrypt/asymmetricrypt Packagist
- Версии
- 0.1.0
- 0.2.0
- 0.2.1
- 0.3.0
- Затронутые диапазоны версий
- ECOSYSTEM: ≤ 0.3.0
Нет опубликованного исправления
Первоисточники
- https://github.com/Cosmicist/AsymmetriCrypt/issues/4
- https://github.com/Cosmicist/AsymmetriCrypt/pull/5
- https://github.com/Cosmicist/AsymmetriCrypt
- https://github.com/FriendsOfPHP/security-advisories/blob/master/asymmetricrypt/asymmetricrypt/2017-11-20.yaml
- https://osv.dev/vulnerability/GHSA-87mp-xc4x-x8rh