cwe-780-rsa-without-oaep

Using RSA encryption with PKCS1Padding triggers CWE-780 because it lacks OAEP padding, exposing sensitive data to cryptographic attacks. Replacing it with OAEPWithSHA-256AndMGF1Padding remediates this vulnerability.

To fix RSA encryption using OAEP padding, replace the insecure "RSA/ECB/PKCS1Padding" cipher instance with "RSA/ECB/OAEPWithSHA-256AndMGF1Padding" and explicitly implement OAEPParameterSpec for secure configuration.

The best way to remediate SAST findings for cryptographic failures in Java is to replace weak PKCS1 padding with OAEP padding, ensuring robust cryptographic schemes are used for RSA encryption.

Yes, explicit implementation of OAEPParameterSpec is required to properly secure RSA encryption in Java, ensuring the cryptographic parameters for OAEP padding are correctly applied.

Yes, replacing insecure PKCS1 padding with OAEPWithSHA-256AndMGF1Padding satisfies security audit requirements by remediating CWE-780 vulnerabilities and ensuring robust cryptographic practices in Java.

You should never use PKCS1Padding for RSA encryption when handling sensitive data, as it is vulnerable to cryptographic attacks and will be flagged during security reviews as a CWE-780 vulnerability.