Threats affecting pkg:nuget/SteeltoeOSS/steeltoe.configuration.encryption

Steeltoe.Configuration.Encryption versions 4.0.0 through 4.1.0 contain a vulnerability where configuring RSA encryption with the OAEP algorithm does not actually enable OAEP. Instead, due to an incorrect transformation string in the BouncyCastle library, the OAEP setting falls back to using PKCS#1 v1.5 encryption, which is less secure. This issue is fixed in version 4.2.0.