IT10701: JWE DECRYPT ACTION AND GATEWAYSCRIPT CRYPTO AND JOSE MODULES MIGHT BE VULNERABLE TO THE PADDING ORACLE ATTACK

Fix packs for DataPower Gateway version 7.2

APAR status

• Closed as program error.

Error description

• The JWE decrypt action and GatewayScript crypto and JOSE modules
  might be vulnerable to the padding oracle attack in some
  scenarios.  Any decryption operation that uses these components
  might face this security exposure.
  

Local fix

• Sign the encrypted data, and put a verify operation before the
  decrypt operation.
  

Problem summary

• Affects users who decrypt untrusted data using either the JWE
  decrypt action or GatewayScript programs that perform decrypt
  operations that use the crypto or JOSE modules.
  
  The JWE decrypt action and GatewayScript crypto and JOSE modules
   may be vulnerable to the 'padding oracle attack' in some
  scenarios.
  Any decryption operation that uses these components faces this
  security exposure.
  

Problem conclusion

• Fix is available in 7.2.0.1
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  DATAPOWER

• Fixed component ID

  DP1234567

Applicable component levels

• R720 PSY

     UP