search

robrichards / xmlseclibs

A PHP library for XML Security
BSD 3-Clause "New" or "Revised" License
386 stars 180 forks source link

Use of RSA Algorithm without OAEP #260

Closed infocube-dev-team closed 6 months ago

infocube-dev-team commented 6 months ago

A scan we have executed on the source code of the library (version 3.1.0, latest at time of writing) highlighted that the encryption function at RSA/ECB/PKCS1Padding is using a weak padding scheme.

With RSA encryption, ensure that the padding scheme used is OAEP. While PKCSv1 may be default for several libraries, frameworks, or languages, it is known to be weak and should not be used.

The affected file is xmlseclibs-3.1.0/src/XMLSecurityKey.php at lines 486, 501, 516, 531.

Please let us know if this is a genuine issue or a false positive.

tvdijen commented 6 months ago

The padding scheme depends on the encryption algorithm being used: https://github.com/robrichards/xmlseclibs/blob/3.1.1/src/XMLSecurityKey.php#L185-L207

Unless you're using RSA 1.5, the padding scheme is set to OAEP.

P.S.: Unless your audit took 3.5 yrs, the latest version is 3.1.1.

infocube-dev-team commented 6 months ago

Thank you, it is clear.

PS When I open https://github.com/robrichards/xmlseclibs I see that the release marked as "latest" is 3.1.0. I will upgrade to 3.1.1.

Thanks for the support!