Usage of "AES/CBC/PKCS5Padding" is insecure

[mahirkabir]

In file https://github.com/apache/cloudstack/blob/0f3f2a09370a18301db28ec3d28efe746b6437c9/services/console-proxy/server/src/main/java/com/cloud/consoleproxy/ConsoleProxyPasswordBasedEncryptor.java (at Line 61), insecure "AES/CBC/PKCS5Padding" was used for encryption.

Security Impact:

Cipher Block Chaining (CBC) with PKCS#5 padding (or PKCS#7) is susceptible to padding oracle attacks

Useful Resources:

https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-4432

Solution we suggest:

Use GCM mode instead of ECB mode.

Please share with us your opinions/comments if there is any:

Is the bug report helpful?

[DaanHoogland]

Is the bug report helpful?

Do you have an exploit or a mitigation, @Mahir92 ?

[weizhouapache]

when PR #7003 is merged, AeadBase64Encryptor can be used to replace cipher "AES/CBC/PKCS5Padding"