search

Security-Industry-Association / libosdp-conformance

Apache License 2.0
27 stars 14 forks source link

OSDP_ISTATR sent in plain text in SC #37

Closed sosroz closed 2 years ago

sosroz commented 2 years ago

When in SC, the OSDP_ISTATR response is being sent int the clear.

The fix would be to update _process_osdpmessage in src-lib/oo-util.c to change

_status = send_message (context, OSDP_ISTATR, p_card.addr, &current_length, sizeof (osdp_istat_response_data), osdp_istat_responsedata);

to

_status = send_message_ex (context, OSDP_ISTATR, p_card.addr, &current_length, sizeof (osdp_istat_response_data), osdp_istat_response_data, OSDP_SEC_SCS18, 0, NULL);

rsgmodelworks commented 2 years ago

fixed