Description
openssl_encrypt versions before 1.4.0 expose passwords passed via the --password CLI argument in process listings accessible to all system users. Attackers can read process arguments through ps aux or /proc/[pid]/cmdline to retrieve plaintext passwords and keystore passwords.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| jahlives | openssl_encrypt | < 1.4.0 | 1.4.0 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | openssl-encrypt | < 1.4.0 | 1.4.0 | GHSA-h3m5-p59h-x88p |
References
- GitHub Security Advisory (GHSA-h3m5-p59h-x88p) vendor-advisory
- VulnCheck Advisory: openssl_encrypt before 1.4.0 Password Exposure via CLI Argument third-party-advisory