Padding Oracle Vulnerability

[paragonie-scott]

php-travis-encrypter/src/Travis/Encrypter/Encrypter.php

Lines 43 to 46 in 12e4670

	$rsa = new RSA();
	$rsa->loadKey($this->key);
	$rsa->setEncryptionMode(RSA::ENCRYPTION_PKCS1);
	$result = $rsa->encrypt($this->envName.'='.$this->envValue);

See https://framework.zend.com/security/advisory/ZF2015-10 or Daniel Bleichenbacher's 1998 paper about padding oracle attacks against RSA with PKCS1v1.5 padding to learn why this is a vulnerability.

[peter279k]

Hi @paragonie-scott, thank you for your reply.
I also notice that problem, but this is the travis-ci problem....
Please see this issue.

Thanks.