{"action":"created","issue":{"url":"https://api.github.com/repos/mako-framework/framework/issues/183","repository_url":"https://api.github.com/repos/mako-framework/framework","labels_url":"https://api.github.com/repos/mako-framework/framework/issues/183/labels{/name}","comments_url":"https://api.github.com/repos/mako-framework/framework/issues/183/comments","events_url":"https://api.github.com/repos/mako-framework/framework/issues/183/events","html_url":"https://github.com/mako-framework/framework/issues/183","id":168358468,"number":183,"title":"OpenSSL Encrypter is vulnerable to Chosen-Ciphertext Attacks","user":{"login":"paragonie-scott","id":11591518,"avatar_url":"https://avatars.githubusercontent.com/u/11591518?v=3","gravatar_id":"","url":"https://api.github.com/users/paragonie-scott","html_url":"https://github.com/paragonie-scott","followers_url":"https://api.github.com/users/paragonie-scott/followers","following_url":"https://api.github.com/users/paragonie-scott/following{/other_user}","gists_url":"https://api.github.com/users/paragonie-scott/gists{/gist_id}","starred_url":"https://api.github.com/users/paragonie-scott/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/paragonie-scott/subscriptions","organizations_url":"https://api.github.com/users/paragonie-scott/orgs","repos_url":"https://api.github.com/users/paragonie-scott/repos","events_url":"https://api.github.com/users/paragonie-scott/events{/privacy}","received_events_url":"https://api.github.com/users/paragonie-scott/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2016-07-29T16:03:56Z","updated_at":"2016-07-29T17:59:14Z","closed_at":null,"body":"https://github.com/mako-framework/framework/blob/4bf7386aead7d65b8d34d5b45874e566b02eb449/src/mako/security/crypto/encrypters/OpenSSL.php\r\n\r\nYou're not applying a MAC over the IV and ciphertext and validating it before attempting decryption.\r\n\r\n(OFB isn't an AEAD mode, and AEAD modes are only supported by PHP in 7.1.0 and newer, which isn't out yet.)"},"comment":{"url":"https://api.github.com/repos/mako-framework/framework/issues/comments/236249967","html_url":"https://github.com/mako-framework/framework/issues/183#issuecomment-236249967","issue_url":"https://api.github.com/repos/mako-framework/framework/issues/183","id":236249967,"user":{"login":"letr0n","id":7405227,"avatar_url":"https://avatars.githubusercontent.com/u/7405227?v=3","gravatar_id":"","url":"https://api.github.com/users/letr0n","html_url":"https://github.com/letr0n","followers_url":"https://api.github.com/users/letr0n/followers","following_url":"https://api.github.com/users/letr0n/following{/other_user}","gists_url":"https://api.github.com/users/letr0n/gists{/gist_id}","starred_url":"https://api.github.com/users/letr0n/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/letr0n/subscriptions","organizations_url":"https://api.github.com/users/letr0n/orgs","repos_url":"https://api.github.com/users/letr0n/repos","events_url":"https://api.github.com/users/letr0n/events{/privacy}","received_events_url":"https://api.github.com/users/letr0n/received_events","type":"User","site_admin":false},"created_at":"2016-07-29T17:59:14Z","updated_at":"2016-07-29T17:59:14Z","body":"It can be done using the [encryptAndSign](https://github.com/mako-framework/framework/blob/master/src/mako/security/crypto/Crypto.php#L92) method but I agree that it should be done by default and not be optional."}}
{"actor":{"display_login":"letr0n"}}