Cryptographic API Misuse Vulnerability

[lialon]

Description:

In the "certgrinder/server/certgrinderd/certgrinderd.py", I have identified a security vulnerability about insecure cryptographic algorithm. PKCS1v1.5 is vulnerable to the chosen-ciphertext attack.

Location:

https://github.com/tykling/certgrinder/blob/main/server/certgrinderd/certgrinderd.py#L985

padding=primitives.asymmetric.padding.PKCS1v15(),

Reference

• CWE-780: Use of RSA Algorithm without OAEP

Recommendations:

Try using other padding(OAEP) instead of PKCS1v1.5.