Cryptographic API Misuse Vulnerability

[lialon]

Description:

In the "Flashlight/PluginDirectories/1/NightFoxAmbient.bundle/oauthlib/oauth1/rfc5849
/signature.py", I have identified security vulnerabilities about insecure cryptographic algorithm. PKCS1v1.5 is vulnerable to the chosen-ciphertext attack.

Location:

https://github.com/nate-parrott/Flashlight/blob/master/PluginDirectories/1/NightFoxAmbient.bundle/oauthlib/oauth1/rfc5849/signature.py#L591

p = PKCS1_v1_5.new(key)

https://github.com/nate-parrott/Flashlight/blob/master/PluginDirectories/1/NightFoxAmbient.bundle/oauthlib/oauth1/rfc5849/signature.py#L494

p = PKCS1_v1_5.new(key)

Reference

• CWE-780: Use of RSA Algorithm without OAEP

Recommendations:

Try using other padding(OAEP) instead of PKCS1v1.5.