【低危】Steeltoe.Configuration.Encryption 安全更新（GHSA-4j9m-h44m-2hv8）

安全情报快照 · 风险级别：低危 · CVSS：1.9 · CVE-2026-50268 · GHSA-4j9m-h44m-2hv8

先看结论

Steeltoe.Configuration.Encryption存在安全风险，>= 4.0.0, <= 4.1.0 受影响，建议升级至 4.2.0。

影响范围

处置建议

优先将 Steeltoe.Configuration.Encryption 升级至 4.2.0 或更高版本；升级前请结合业务依赖完成兼容性验证。

上游技术详情（原文）

Summary

Configuring encrypt:rsa:algorithm=OAEP does not enable OAEP encryption. Due to an incorrect BouncyCastle transformation string, the OAEP setting selects PKCS#1 v1.5, which is the same algorithm as the DEFAULT setting.

Impact

Operators who configure encrypt:rsa:algorithm=OAEP to obtain CCA2-secure padding receive PKCS#1 v1.5 instead. Currently, Decrypt() is called only against operator-controlled configuration data, so no exploitable path exists, but any future code path that exposes a decryption oracle would be Bleichenbacher-vulnerable despite the OAEP setting.

Migration note

Existing {cipher} values produced under the broken OAEP setting were encrypted with PKCS#1 v1.5. The fix makes OAEP use actual OAEP padding, so those values will fail to decrypt after upgrading. Re-encrypt all affected {cipher} values after upgrading.

来源与许可

• GitHub Advisory GHSA-4j9m-h44m-2hv8
• https://github.com/SteeltoeOSS/security-advisories/security/advisories/GHSA-4j9m-h44m-2hv8
• https://nvd.nist.gov/vuln/detail/CVE-2026-50268
• https://github.com/SteeltoeOSS/Steeltoe/commit/6cfee5cccddf8f9a31de69b0ca5ccdd771b73e5b

本页自动同步 GitHub Advisory Database 的公开数据，并保留上游原文供核验；不宣称原创分析。数据许可：CC-BY-4.0。