Description
openssl_encrypt versions before 1.4.0 use Python's non-cryptographic random module for steganographic pixel selection in the generate_pseudorandom_sequence function. Attackers who know the password can recover the Mersenne Twister state from approximately 624 outputs and predict pixel locations containing hidden data for extraction.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| jahlives | openssl_encrypt | < 1.4.0 | 1.4.0 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | openssl-encrypt | < 1.4.0 | 1.4.0 | GHSA-vfgx-5q85-58q3 |
References
- GitHub Security Advisory (GHSA-vfgx-5q85-58q3) vendor-advisory
- VulnCheck Advisory: openssl_encrypt before 1.4.0 Weak PRNG Steganography Pixel Selection third-party-advisory