Summary
RSA PKCS#1 v1.5 (rsa-1_5) key transport was supported with distinguishable decryption error paths (padding failure vs symmetric failure), enabling a Bleichenbacher padding oracle. locateKey() also accepted attacker-chosen EncryptionMethod algorithms from XML without policy checks.
Details
Default-safe: XMLSecEnc denies RSA-1.5 key transport unless allowRSA15KeyTransport = true. All decryption failures use a uniform message. Legacy opt-in: On PKCS#1 v1.5 padding failure, RFC 3218 §2.3.2 random session-key substitution prevents distinguishing invalid padding from wrong key material (decryptPrivateRsa()). Prefer RSA-OAEP and AES-GCM.
Upgrade / mitigation
- Upgrade to 4.0.0+.
- Do not enable
allowRSA15KeyTransport unless required for legacy peers; migrate to RSA-OAEP + AES-GCM.
Users of xmlseclibs in SAML, WS-Security, or other XML signature/encryption flows should upgrade to 4.0.0 or later. Review the 4.0 migration notes in CHANGELOG.txt and README.md. Prefer verifyDocument() with a pinned trusted key and XMLSecEnc algorithm allowlists (DEFAULT_KEY_ALGORITHMS, DEFAULT_DATA_ALGORITHMS). Use enableLegacyMode() only temporarily while migrating legacy peers.
Summary
RSA PKCS#1 v1.5 (
rsa-1_5) key transport was supported with distinguishable decryption error paths (padding failure vs symmetric failure), enabling a Bleichenbacher padding oracle.locateKey()also accepted attacker-chosenEncryptionMethodalgorithms from XML without policy checks.Details
Default-safe:
XMLSecEncdenies RSA-1.5 key transport unlessallowRSA15KeyTransport = true. All decryption failures use a uniform message. Legacy opt-in: On PKCS#1 v1.5 padding failure, RFC 3218 §2.3.2 random session-key substitution prevents distinguishing invalid padding from wrong key material (decryptPrivateRsa()). Prefer RSA-OAEP and AES-GCM.Upgrade / mitigation
allowRSA15KeyTransportunless required for legacy peers; migrate to RSA-OAEP + AES-GCM.Users of xmlseclibs in SAML, WS-Security, or other XML signature/encryption flows should upgrade to 4.0.0 or later. Review the 4.0 migration notes in
CHANGELOG.txtandREADME.md. PreferverifyDocument()with a pinned trusted key andXMLSecEncalgorithm allowlists (DEFAULT_KEY_ALGORITHMS,DEFAULT_DATA_ALGORITHMS). UseenableLegacyMode()only temporarily while migrating legacy peers.