Description
openssl_encrypt versions before 1.4.9 contain an insecure file permissions vulnerability in the desktop GUI that writes decrypted plaintext with world-readable default permissions. Attackers can read decrypted output files created by the GUI as unprivileged local users on multi-user systems.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| jahlives | openssl_encrypt | < 1.4.9 | 1.4.9 |
References
- GitHub Security Advisory (GHSA-7q4g-rrw4-rf2m) vendor-advisory
- VulnCheck Advisory: openssl_encrypt before 1.4.9 Insecure File Permissions third-party-advisory