PT-2026-55358 · Nuget · Steeltoe.Configuration.Encryption

Publicado 2026-07-02 · Atualizado 2026-07-02

OSV

CVSS v3.1

1.9

Baixa

Vetor base

AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N

Summary

Configuring encrypt:rsa:algorithm=OAEP does not enable OAEP encryption. Due to an incorrect BouncyCastle transformation string, the OAEP setting selects PKCS#1 v1.5, which is the same algorithm as the DEFAULT setting.

Impact

Operators who configure encrypt:rsa:algorithm=OAEP to obtain CCA2-secure padding receive PKCS#1 v1.5 instead. Currently, Decrypt() is called only against operator-controlled configuration data, so no exploitable path exists, but any future code path that exposes a decryption oracle would be Bleichenbacher-vulnerable despite the OAEP setting.

Migration note

Existing {cipher} values produced under the broken OAEP setting were encrypted with PKCS#1 v1.5. The fix makes OAEP use actual OAEP padding, so those values will fail to decrypt after upgrading. Re-encrypt all affected {cipher} values after upgrading.

Correção

Use of a Broken Cryptographic Algorithm

Enumeração de Fraquezas

CWE-256

CWE-327

Identificadores relacionados

GHSA-4J9M-H44M-2HV8

Produtos afetados

Steeltoe.Configuration.Encryption

Referências · 5

• https://github.com/SteeltoeOSS/Steeltoe/commit/6cfee5cccddf8f9a31de69b0ca5ccdd771b73e5b · Nota
• https://osv.dev/vulnerability/GHSA-4j9m-h44m-2hv8 · Aviso do Fabricante
• https://github.com/SteeltoeOSS/security-advisories/security/advisories/GHSA-4j9m-h44m-2hv8 · Nota
• https://github.com/SteeltoeOSS/security-advisories · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-50268 · Nota de Segurança