Skip to content

RSA PKCS#1 v1.5 Bleichenbacher Padding Oracle via Distinguishable Decryption Errors in xmlseclibs

Moderate
robrichards published GHSA-39hg-wfcm-v4wv Aug 24, 2026

Package

composer robrichards/xmlseclibs (Composer)

Affected versions

< 4.0.0

Patched versions

4.0.0

Description

Summary

RSA PKCS#1 v1.5 (rsa-1_5) key transport was supported with distinguishable decryption error paths (padding failure vs symmetric failure), enabling a Bleichenbacher padding oracle. locateKey() also accepted attacker-chosen EncryptionMethod algorithms from XML without policy checks.

Details

Default-safe: XMLSecEnc denies RSA-1.5 key transport unless allowRSA15KeyTransport = true. All decryption failures use a uniform message. Legacy opt-in: On PKCS#1 v1.5 padding failure, RFC 3218 §2.3.2 random session-key substitution prevents distinguishing invalid padding from wrong key material (decryptPrivateRsa()). Prefer RSA-OAEP and AES-GCM.

Upgrade / mitigation

  • Upgrade to 4.0.0+.
  • Do not enable allowRSA15KeyTransport unless required for legacy peers; migrate to RSA-OAEP + AES-GCM.

Users of xmlseclibs in SAML, WS-Security, or other XML signature/encryption flows should upgrade to 4.0.0 or later. Review the 4.0 migration notes in CHANGELOG.txt and README.md. Prefer verifyDocument() with a pinned trusted key and XMLSecEnc algorithm allowlists (DEFAULT_KEY_ALGORITHMS, DEFAULT_DATA_ALGORITHMS). Use enableLegacyMode() only temporarily while migrating legacy peers.

Severity

Moderate

CVE ID

No known CVE

Weaknesses

Observable Discrepancy

The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not. Learn more on MITRE.

Credits