#2310 switch to a non vulnerable padding mechanism

J12934 · J12934 · commit fe160189e13d · 2024-02-23T10:26:13.000+01:00
Signed-off-by: Jannik Hollenbach &lt;jannik.hollenbach@iteratec.com&gt;
diff --git a/scanners/ncrack/parser/parser.js b/scanners/ncrack/parser/parser.js
@@ -4,7 +4,7 @@
 
 const xml2js = require("xml2js");
 const crypto = require("crypto");
-const { readFile } = require("fs/promises");
+const {readFile} = require("fs/promises");
 
 async function parse(
   fileContent,
@@ -37,7 +37,7 @@ function transformToFindings(ncrackrun, publicKey) {
           .publicEncrypt(
             {
               key: publicKey,
-              padding: crypto.constants.RSA_PKCS1_PADDING,
+              padding: crypto.constants.RSA_PKCS1_OAEP_PADDING,
             },
             Buffer.from(password)
           )
diff --git a/scanners/ncrack/parser/parser.test.js b/scanners/ncrack/parser/parser.test.js
@@ -142,7 +142,7 @@ it("should encrypt findings when a public key is set", async () => {
   let decryptedData = crypto.privateDecrypt(
     {
       key: privateKey,
-      padding: crypto.constants.RSA_PKCS1_PADDING,
+      padding: crypto.constants.RSA_PKCS1_OAEP_PADDING,
     },
     Buffer.from(finding.attributes.password, "base64")
   );

Original file line number	Diff line number	Diff line change
`@@ -142,7 +142,7 @@ it("should encrypt findings when a public key is set", async () => {`
`142`	`142`	`let decryptedData = crypto.privateDecrypt(`
`143`	`143`	`{`
`144`	`144`	`key: privateKey,`
`145`		`- padding: crypto.constants.RSA_PKCS1_PADDING,`
	`145`	`+ padding: crypto.constants.RSA_PKCS1_OAEP_PADDING,`
`146`	`146`	`},`
`147`	`147`	`Buffer.from(finding.attributes.password, "base64")`
`148`	`148`	`);`