Description
openssl_encrypt versions before 1.4.0 contain an authentication bypass vulnerability in CamelliaCipher that disables HMAC tag generation and verification when the PYTEST_CURRENT_TEST environment variable is set. Attackers with code execution can set this environment variable to produce unauthenticated ciphertext and bypass integrity protection on encrypted data.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| jahlives | openssl_encrypt | < 1.4.0 | 1.4.0 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | openssl-encrypt | < 1.4.0 | 1.4.0 | PYSEC-2026-3766 |
References
- GitHub Security Advisory (GHSA-rvc2-5jxq-gpcj) vendor-advisory
- VulnCheck Advisory: openssl_encrypt before 1.4.0 HMAC Authentication Bypass via Environment Variable third-party-advisory