Vulnerabilidades do Jahlives Openssl Encrypt

CVE-2026-74885 Baixa · 3.6 CWE-117 17/08/2026

openssl_encrypt before 1.4.0 Logging Bug and Race Condition

openssl_encrypt versions before 1.4.0 contain a logging bug in restore_hidden_modules() that logs module counts after clearing, always showing zero restored modules and corrupting audit trails. Additionally, a race condition exists between module hiding and import hook installation where another thread could re-import blocked modules in multi-threaded environments.

CVE-2026-74884 Alta · 7.5 CWE-73 17/08/2026

openssl_encrypt before 1.4.0 Path Traversal via plugin_id

openssl_encrypt versions before 1.4.0 contain a path traversal vulnerability in the _is_safe_path method where the plugin_id parameter is not sanitized before constructing the plugin config directory path. Attackers can declare a malicious plugin_id containing path traversal sequences like '../' to access arbitrary directories outside the intended plugin directory.

CVE-2026-74883 Alta · 8.8 CWE-693 17/08/2026

openssl_encrypt before 1.4.0 Sandbox Bypass via pathlib and io

openssl_encrypt versions before 1.4.0 contain a sandbox bypass vulnerability where the plugin sandbox fails to restrict alternative file access methods like pathlib.Path and io.open. Attackers can import pathlib or io modules to read and write arbitrary files, completely bypassing the restricted_open file access controls.

CVE-2026-74882 Crítica · 9.1 CWE-345 17/08/2026

openssl_encrypt before 1.4.0 Insecure Default Configuration

openssl_encrypt versions before 1.4.0 contain an insecure default configuration that trusts the entire RFC 1918 private address space in IntegrityProxyConfig trusted_proxies. Attackers on private networks can forge client certificate headers to bypass mTLS authentication when ProxyAuth validation is relaxed or modified.

CVE-2026-74881 Crítica · 9.3 CWE-942 17/08/2026

Jahlives openssl_encrypt anterior à 1.4.0: CORS mal configurado com origens curinga

As versões do openssl_encrypt anteriores à 1.4.0 configuram CORS com allow_origins definido como curinga e allow_credentials habilitado como verdadeiro. Atacantes podem criar sites maliciosos que fazem requisições autenticadas entre origens para a API em nome de qualquer usuário que os visitar.

CVE-2026-74880 Crítica · 9.8 CWE-598 17/08/2026

openssl_encrypt before 1.4.0 Token Leakage via Query Parameters

openssl_encrypt versions before 1.4.0 accept refresh tokens as URL query parameters in keyserver and telemetry server routes. Attackers can extract tokens from server logs, proxy logs, browser history, and HTTP Referer headers to gain unauthorized access.

CVE-2026-74879 Alta · 7.5 CWE-209 17/08/2026

openssl_encrypt before 1.4.0 Information Disclosure via /ready endpoint

openssl_encrypt versions before 1.4.0 contain an information disclosure vulnerability in the /ready endpoint that returns full database exception strings to unauthenticated callers. Attackers can trigger database errors to extract sensitive information including hostnames, IP addresses, connection parameters, and potentially credentials from exception messages.

CVE-2026-74878 Crítica · 9.8 CWE-770 17/08/2026

Contorno do limitador de taxa TOTP no openssl_encrypt

Versões do openssl_encrypt anteriores à 1.4.0 usam um limitador de taxa em memória para a proteção contra força bruta de TOTP que não é compartilhado entre workers e é perdido com a reinicialização do servidor. Atacantes podem distribuir tentativas de autenticação entre várias instâncias do servidor ou tentar novamente imediatamente após uma reinicialização para contornar as proteções de limitação de taxa.

CVE-2026-74877 Alta · 8.8 CWE-639 17/08/2026

openssl_encrypt before 1.4.0 Missing Ownership Verification via revoke_key

openssl_encrypt versions before 1.4.0 contain a missing ownership verification vulnerability in the revoke_key method that allows authenticated clients to revoke any other client's key. Attackers can revoke arbitrary keys by providing a valid ML-DSA signature, bypassing the intended ownership restriction.

CVE-2026-74876 Crítica · 9.8 CWE-347 17/08/2026

openssl_encrypt anterior à 1.4.0: bundles de chaves sem verificação de assinatura

As versões do openssl_encrypt anteriores à 1.4.0 contêm uma vulnerabilidade em PublicKeyBundle.from_dict() que cria bundles de chaves a partir de dados não confiáveis sem verificar assinaturas. Atacantes podem chamar from_dict() seguido de to_identity() sem verificação de assinatura para criptografar dados usando chaves públicas controladas pelo atacante, vazando segredos.

CVE-2026-74871 Média · 5.5 CWE-916 17/08/2026

openssl_encrypt before 1.4.6 KDF Bypass via Sequential-XOR

openssl_encrypt versions before 1.4.6 contain a key derivation flaw in sequential XOR composition mode where the last stage cancels out during key generation. When configured with a single KDF and no prior hashing stage, attackers can bypass memory-hard key derivation and perform offline password cracking at SHA-256 speed instead of the configured KDF cost.

CVE-2026-74870 Baixa · 3.3 CWE-532 17/08/2026

openssl_encrypt before 1.4.8 Hardware Pepper Information Disclosure

openssl_encrypt (pip) versions <= 1.4.7 contain an information exposure vulnerability where the 'hsm fido2-test' and 'hsm onlykey-test' diagnostic commands unconditionally print the full derived hardware pepper as hex to stdout/stderr (crypt_cli.py, handle_hsm_command). The printed value can persist in terminal scrollback, session recordings, or CI logs. Impact is limited because the pepper is derived from a random per-invocation test salt and is salt-bound, so the leaked value cannot be used to decrypt real files. A related plugin issue logged raw prf_data outside the secret-redaction path. Fixed in 1.4.8 (and 1.5.0) by removing the hex dumps and routing plugin debug output through the redaction layer.

CVE-2026-74875 Crítica · 9.8 CWE-345 17/08/2026

openssl_encrypt before 1.4.0 Schema Validation Bypass

openssl_encrypt versions before 1.4.0 silently skip JSON schema validation when the jsonschema library is not installed, allowing malformed metadata to be accepted. Attackers can remove the jsonschema package or supply unknown metadata format versions to bypass all schema checks and process malicious data.

CVE-2026-74874 Alta · 7.5 CWE-338 17/08/2026

openssl_encrypt before 1.4.0 Weak PRNG Steganography Pixel Selection

openssl_encrypt versions before 1.4.0 use Python's non-cryptographic random module for steganographic pixel selection in the generate_pseudorandom_sequence function. Attackers who know the password can recover the Mersenne Twister state from approximately 624 outputs and predict pixel locations containing hidden data for extraction.

CVE-2026-74873 Média · 5.5 CWE-214 17/08/2026

openssl_encrypt before 1.4.0 Password Exposure via CLI Argument

openssl_encrypt versions before 1.4.0 expose passwords passed via the --password CLI argument in process listings accessible to all system users. Attackers can read process arguments through ps aux or /proc/[pid]/cmdline to retrieve plaintext passwords and keystore passwords.

CVE-2026-74872 Crítica · 9.8 CWE-426 17/08/2026

openssl_encrypt before 1.4.0 Arbitrary Code Execution via Whirlpool

openssl_encrypt versions before 1.4.0 contain an arbitrary code execution vulnerability in the Whirlpool hash implementation that uses broad glob patterns to load .so modules without integrity verification. Attackers can place malicious .so files matching the whirlpool*py313*.so pattern in site-packages directories to achieve native code execution when the module is loaded.