17 results · Clear filters · Feed
-
Critical 9.8
openssl_encrypt before 1.4.9 Key Substitution via Identity Load
openssl_encrypt before 1.4.9 fails to re-derive and validate fingerprints when loading identities from identity.json, allowing attackers to substitute public keys in identity stores. Attackers can replace legitimate public keys with their own while maintainin…
-
Critical 9.8
openssl_encrypt before 1.4.9 GPG Signature Verification Bypass
openssl_encrypt versions before 1.4.9 contain a signature verification vulnerability in gpg_runner.verify_detached that accepts revoked and expired keys by only checking VALIDSIG status without inspecting REVKEYSIG, EXPKEYSIG, or gpg exit codes. Attackers hol…
-
Critical 9.8
openssl_encrypt before 1.4.9 Arbitrary Code Execution via unsigned plugin
openssl_encrypt versions before 1.4.9 use a denylist to identify trusted built-in plugins, allowing unsigned plugins in top-level plugins/ directories and unknown subdirectories to bypass signature verification. Attackers can place malicious unsigned plugins …
-
Critical 9.8
openssl_encrypt before 1.4.0 Authentication Bypass via AES-CTR Fallback
openssl_encrypt versions before 1.4.0 contain an authentication bypass vulnerability in pqc.py where AES-GCM decryption failures trigger fallback to unauthenticated AES-CTR mode. Attackers can modify ciphertext in transit to bypass integrity verification and …
-
Critical 9.8
openssl_encrypt before 1.4.0 Weak Shared Secret via PQC Simulation Mode
openssl_encrypt versions before 1.4.0 contain a critical vulnerability in pqc.py where KEM decapsulation failures silently fall back to simulation mode, generating a deterministic shared secret from only 16 bytes of the private key and publicly available enca…
-
Critical 9.8
openssl_encrypt before 1.4.0 Sandbox Escape via Type Hierarchy
openssl_encrypt versions before 1.4.0 contain a sandbox escape vulnerability in IsolatedPluginExecutor that exposes Python type objects in restricted exec() builtins. Attackers can traverse the Python class hierarchy via __class__.__mro__.__subclasses__() to …
-
Critical 9.8
openssl_encrypt before 1.4.0 Plugin Sandbox Bypass via Process Isolation
openssl_encrypt versions before 1.4.0 fail to apply sandbox restrictions in the default process isolation mode for plugin execution. Attackers can execute malicious plugins with unrestricted access to the filesystem, network, subprocess execution, and all Pyt…
-
Critical 9.8
openssl_encrypt before 1.4.0 Sandbox Escape via Dunder Attribute Traversal
openssl_encrypt versions before 1.4.0 contain a sandbox escape vulnerability in the DangerousPatternVisitor AST analyzer that fails to detect dunder attribute traversal techniques. Attackers can use __class__, __bases__, __subclasses__(), and __globals__ chai…
-
Critical 9.8
openssl_encrypt before 1.4.0 Authentication Bypass via Bearer Token
openssl_encrypt before 1.4.0 contains an authentication bypass vulnerability in the verify_api_token function that accepts any non-empty Bearer token string without validation. Attackers can upload arbitrary public keys, enumerate all keys, and revoke keys be…
-
Critical 9.8
openssl_encrypt before 1.4.0 Hardcoded Database Credentials
openssl_encrypt versions before 1.4.0 contain hardcoded database credentials in standalone server configuration files. Attackers on the same network can access PostgreSQL databases using well-known default credentials to retrieve sensitive data.
-
Critical 9.8
openssl_encrypt before 1.4.0 Weak Key Derivation via HKDF
openssl_encrypt versions before 1.4.0 use HKDF with no salt and static info parameter in key normalization functions, reducing entropy extraction and determinism. Attackers can exploit predictable key derivation with identical inputs to weaken cryptographic s…
-
Critical 9.8
openssl_encrypt before 1.4.0 Plugin Import Guard Bypass
openssl_encrypt versions before 1.4.0 contain a plugin sandbox bypass vulnerability where the PluginImportGuard blocks a different set of modules than the AST analyzer's DANGEROUS_MODULES set. Attackers can bypass AST analysis through string obfuscation or en…
-
Critical 9.8
openssl_encrypt before 1.4.0 Token Leakage via Query Parameters
openssl_encrypt versions before 1.4.0 accept refresh tokens as URL query parameters in keyserver and telemetry server routes. Attackers can extract tokens from server logs, proxy logs, browser history, and HTTP Referer headers to gain unauthorized access.
-
Critical 9.8
openssl_encrypt before 1.4.0 TOTP Rate Limiter Bypass
openssl_encrypt versions before 1.4.0 use an in-memory rate limiter for TOTP brute-force protection that is not shared across workers and is lost on server restart. Attackers can distribute authentication attempts across multiple server instances or retry imm…
-
Critical 9.8
openssl_encrypt before 1.4.0 Unverified Key Bundle Encryption
openssl_encrypt versions before 1.4.0 contain a vulnerability in PublicKeyBundle.from_dict() that creates key bundles from untrusted data without verifying signatures. Attackers can call from_dict() followed by to_identity() without signature verification to …
-
Critical 9.8
openssl_encrypt before 1.4.0 Schema Validation Bypass
openssl_encrypt versions before 1.4.0 silently skip JSON schema validation when the jsonschema library is not installed, allowing malformed metadata to be accepted. Attackers can remove the jsonschema package or supply unknown metadata format versions to bypa…
-
Critical 9.8
openssl_encrypt before 1.4.0 Arbitrary Code Execution via Whirlpool
openssl_encrypt versions before 1.4.0 contain an arbitrary code execution vulnerability in the Whirlpool hash implementation that uses broad glob patterns to load .so modules without integrity verification. Attackers can place malicious .so files matching the…