Feeling Lucky
?
[#8328] - JCryptCipherMcrypt::decrypt() - Data Corruption via trim()
- Closed
- 13 Nov 2015
- Medium
- Build: master
- # 8328
Depending on how the data is formatted prior to encryption, we can lose information after decrypting a message.
Proof of Concept: https://3v4l.org/bSoNu
Recommendation: Use PKCS7 padding before encryption, don't use trim() or rtrim(); actually remove the padding carefully.
PhilETaylor
- comment
- 9 Nov 2015
@paragonie-scott Would you be able to provide a mergeable pull request with the changes you are proposing please? Code speaks louder than comments :-)
zero-24
- | Labels |
Added:
?
|
||
| Category | ⇒ | Libraries |
mbabker
- comment
- 12 Nov 2015
@joomla/security Some help on this issue would be appreciated. I'm in over my head on this.
roland-d
- comment
- 13 Nov 2015
Closing this issue as we have a pull request #8406 Thanks @paragonie-scott
| Status | New | ⇒ | Closed |
| Closed_Date | 0000-00-00 00:00:00 | ⇒ | 2015-11-13 21:19:04 |
| Closed_By | ⇒ | roland-d |
Note: PKCS7 padding without authenticating the ciphertext doesn't change the security level, but it does guarantee a valid result.