Lowtimhess

**Name of the Vulnerable Software and Affected Versions** Steeltoe.Configuration.Encryption versions 4.0.0 through 4.1.0 **Description** Steeltoe is an open source project providing libraries for building cloud-native applications. An issue exists where configuring the `encrypt:rsa:algorithm` variable with the value `OAEP` fails to enable OAEP encryption. Due to an incorrect BouncyCastle transformation string, the `OAEP` setting instead selects PKCS#1 v1.5, which is the same algorithm used by the `DEFAULT` setting. **Recommendations** Update Steeltoe.Configuration.Encryption to version 4.2.0.