A misconfiguration of RSA padding implemented in the PingID Adapter for PingFederate to support Offline MFA with PingID mobile authenticators is vulnerable to pre-computed dictionary attacks, leading to a bypass of offline MFA.
Weakness
The product uses the RSA algorithm but does not incorporate Optimal Asymmetric Encryption Padding (OAEP), which might weaken the encryption.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Pingfederate | Pingidentity | 11.1.0 (including) | 11.1.5 (including) |
| Pingfederate | Pingidentity | 11.2.0 (including) | 11.2.2 (including) |
| Pingid_adapter_for_pingfederate | Pingidentity | * | 2.13.2 (excluding) |
| Pingid_integration_kit | Pingidentity | * | 2.24 (excluding) |
References
- https://docs.pingidentity.com/r/en-us/pingid/pingid_adapter_configuring_offline_mfa
- https://docs.pingidentity.com/r/en-us/pingid/pingid_integration_kit_2_20_rn
- https://docs.pingidentity.com/r/en-us/pingid/pingid_adapter_configuring_offline_mfa
- https://docs.pingidentity.com/r/en-us/pingid/pingid_integration_kit_2_20_rn