CVE-2015-7503: Infoleak
It was found that Zend\Crypt\PublicKey\Rsa\PublicKey has a call to opensslpublicencrypt(), which uses PHP's default $padding argument, which specifies OPENSSLPKCS1PADDING, indicating usage of PKCS1v1.5 padding. This padding has a known vulnerability, the Bleichenbacher's chosen-ciphertext attack, that can be used to recover an RSA private key.
Other sources
Potential Information Disclosure in Zend\Crypt\PublicKey\Rsa\PublicKey
Zend Framework before 2.4.9, zend-framework/zend-crypt 2.4.x before 2.4.9, and 2.5.x before 2.5.2 allows remote attackers to recover the RSA private key.
— GitHub
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-7503?
CVE-2015-7503 is considered a moderate security vulnerability due to the potential for Bleichenbacher's chosen-ciphertext attack.
How do I fix CVE-2015-7503?
To remediate CVE-2015-7503, update zend-crypt to version 2.4.9 or later, or zendframework to version 2.5.2 or later.
What versions are affected by CVE-2015-7503?
CVE-2015-7503 affects zend-crypt versions from 2.0.0 to 2.4.9 and zendframework versions from 2.0.0 to 2.4.9.
What components are involved in CVE-2015-7503?
CVE-2015-7503 involves the `Zend\Crypt\PublicKey\Rsa\PublicKey` and the use of the openssl_public_encrypt function.
Is CVE-2015-7503 a known issue in PHP?
Yes, CVE-2015-7503 highlights a known issue with PHP's default padding mechanism in cryptographic operations.