steeltoeoss/security-advisories · Security
Steeltoe: OAEP setting silently selects PKCS#1 v1.5 padding
- GHSA ID
- GHSA-4j9m-h44m-2hv8
- CVE ID
- CVE-2026-50268
- Severity
- low
- Published
- Updated
- CVSS
- 1.9 · CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N
- CVSS v3
- 1.9 · CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N
Description
Summary
Configuring encrypt:rsa:algorithm=OAEP does not enable OAEP encryption. Due to an incorrect BouncyCastle transformation string, the OAEP setting selects PKCS#1 v1.5, which is the same algorithm as the DEFAULT setting.
Impact
Operators who configure encrypt:rsa:algorithm=OAEP to obtain CCA2-secure padding receive PKCS#1 v1.5 instead. Currently, Decrypt() is called only against operator-controlled configuration data, so no exploitable path exists, but any future code path that exposes a decryption oracle would be Bleichenbacher-vulnerable despite the OAEP setting.
Migration note
Existing {cipher} values produced under the broken OAEP setting were encrypted with PKCS#1 v1.5. The fix makes OAEP use actual OAEP padding, so those values will fail to decrypt after upgrading. Re-encrypt all affected {cipher} values after upgrading.
CWEs
- CWE-256 · Plaintext Storage of a Password
- CWE-327 · Use of a Broken or Risky Cryptographic Algorithm