CWE-780 未配合OAEP使用RSA算法 类弱点 3 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-780 属于加密实现缺陷。当 RSA 算法未采用 OAEP 填充时，明文结构过于规律，易受选择密文攻击或确定性攻击影响。攻击者可利用此弱点推测或解密数据。开发者应强制使用 OAEP 等安全填充方案，确保明文随机化，从而消除可预测性，增强加密强度并抵御相关攻击。
public Cipher getRSACipher() { Cipher rsa = null; try { rsa = javax.crypto.Cipher.getInstance("RSA/NONE/NoPadding"); } catch (java.security.NoSuchAlgorithmException e) { log("this should never happen", e); } catch (javax.crypto.NoSuchPaddingException e) { log("this should never happen", e); } return rsa; }public Cipher getRSACipher() { Cipher rsa = null; try { rsa = javax.crypto.Cipher.getInstance("RSA/ECB/OAEPWithMD5AndMGF1Padding"); } catch (java.security.NoSuchAlgorithmException e) { log("this should never happen", e); } catch (javax.crypto.NoSuchPaddingException e) { log("this should never happen", e); } return rsa; }| CVE ID | タイトル | CVSS | 深刻度 | 公開日 |
|---|---|---|---|---|
| CVE-2025-9071 | Insecure RSA-OAEP implementation with all-zero seed for padding in Oberon PSA Crypto — Oberon PSA Crypto | 7.5 | - | 2025-08-29 |
| CVE-2024-51456 | IBM Robotic Process Automation information disclosure — Robotic Process Automation | 5.9 | Medium | 2025-01-12 |
| CVE-2022-40722 | Misconfiguration of RSA padding for offline MFA in the PingID Adapter for PingFederate. — PingID Adapter for PingFederate | 7.7 | High | 2023-04-25 |
CWE-780（未配合OAEP使用RSA算法） 是常见的弱点类别，本平台收录该类弱点关联的 3 条 CVE 漏洞。