From 18a99fa7429bd28486446a7e4222113b347c2e07 Mon Sep 17 00:00:00 2001
From: Valery Kharseko <vharseko@3a-systems.ru>
Date: Tue, 28 Jul 2026 16:18:16 +0000
Subject: [PATCH] Fix java/rsa-without-oaep CodeQL alert by dropping the RSA PKCS#1 v1.5 fallback (#776)
---
opendj-server-legacy/src/main/java/org/opends/server/tools/ConfigureDS.java | 7 +++++--
1 files changed, 5 insertions(+), 2 deletions(-)
diff --git a/opendj-server-legacy/src/main/java/org/opends/server/tools/ConfigureDS.java b/opendj-server-legacy/src/main/java/org/opends/server/tools/ConfigureDS.java
index e09f413..6fe8aae 100644
--- a/opendj-server-legacy/src/main/java/org/opends/server/tools/ConfigureDS.java
+++ b/opendj-server-legacy/src/main/java/org/opends/server/tools/ConfigureDS.java
@@ -13,6 +13,7 @@
*
* Copyright 2006-2009 Sun Microsystems, Inc.
* Portions Copyright 2012-2016 ForgeRock AS.
+ * Portions Copyright 2026 3A Systems, LLC.
*/
package org.opends.server.tools;
@@ -1291,10 +1292,12 @@
*/
private static String getAlternativeCipher()
{
+ // Only OAEP variants belong here: RSA with PKCS#1 v1.5 padding is vulnerable to
+ // Bleichenbacher-style padding oracle attacks and must not be used to wrap the
+ // CryptoManager secret keys.
final String[] preferredAlternativeCiphers =
{
- "RSA/ECB/OAEPWITHSHA1ANDMGF1PADDING",
- "RSA/ECB/PKCS1Padding"
+ "RSA/ECB/OAEPWITHSHA1ANDMGF1PADDING"
};
for (final String cipher : preferredAlternativeCiphers)
{
--
Gitblit v1.10.0