fields_to_partial_json() in jwk.py reads RSA private key
- Dominant language
- Python
- Stars
- 48
- Forks
- 34
- Avg merge
- 2m
- Merged PRs (30d)
- 1
Description
Using an RSA provided by an HSM I discovered a code path where josepy attempted to read the private key "numbers" when calling challenge.validation() on a DNS challenge (passing in the RSAKey object).
The specific issue is on line 269, and then the values from that key are then read in 274-279.
https://github.com/certbot/josepy/blob/fbee9f206c6e26ed0b1cd9e2823e6be57af3e40e/src/josepy/jwk.py#L269
This in definitely incorrect since RSA private keys should be kept completely private, but does work when the the RSAPrivateKey allows you to read those numbers. However, if the RSA key is stored in an HSM this is (rightly) impossible.
Commenting out those lines appears to have no ill effect - at least on DNS challenges and Let's Encrypt's staging server. I was able to submit an order, retrieve the challenges, call .validate() on both the DNS and HTTP challenges, answer the DNS challenge, finalize the order, and retrieve the certificate.
I found a similar issue in the ECDSA code (lines 364, 366, 394), but did not do any testing on changing those.
I'm happy to provide a pull request if you would like, but thought I should open the issue first to discuss.
Contributor guide
Assessment
This issue has not been assessed yet.