Summary
Symmetric CBC decryption used ISO 10126 unpadding without validating pad length and surfaced distinguishable errors on failure, enabling a padding oracle against encrypted XML content.
Details
unpadISO10126() validates pad length against block size. All symmetric and asymmetric decryption failures are normalized to a single generic Failure decrypting Data exception so callers cannot distinguish padding errors from other failures.
Upgrade / mitigation
- Upgrade to 4.0.0+.
- Pin data algorithms to GCM via
$objenc->allowedDataAlgorithms = XMLSecEnc::DEFAULT_DATA_ALGORITHMS.
Users of xmlseclibs in SAML, WS-Security, or other XML signature/encryption flows should upgrade to 4.0.0 or later. Review the 4.0 migration notes in CHANGELOG.txt and README.md. Prefer verifyDocument() with a pinned trusted key and XMLSecEnc algorithm allowlists (DEFAULT_KEY_ALGORITHMS, DEFAULT_DATA_ALGORITHMS). Use enableLegacyMode() only temporarily while migrating legacy peers.
Summary
Symmetric CBC decryption used ISO 10126 unpadding without validating pad length and surfaced distinguishable errors on failure, enabling a padding oracle against encrypted XML content.
Details
unpadISO10126()validates pad length against block size. All symmetric and asymmetric decryption failures are normalized to a single genericFailure decrypting Dataexception so callers cannot distinguish padding errors from other failures.Upgrade / mitigation
$objenc->allowedDataAlgorithms = XMLSecEnc::DEFAULT_DATA_ALGORITHMS.Users of xmlseclibs in SAML, WS-Security, or other XML signature/encryption flows should upgrade to 4.0.0 or later. Review the 4.0 migration notes in
CHANGELOG.txtandREADME.md. PreferverifyDocument()with a pinned trusted key andXMLSecEncalgorithm allowlists (DEFAULT_KEY_ALGORITHMS,DEFAULT_DATA_ALGORITHMS). UseenableLegacyMode()only temporarily while migrating legacy peers.