Description
openssl_encrypt versions before 1.4.9 fail to sanitize recovery-slot metadata in the desktop GUI, allowing attackers to inject control characters and line separators into the irreversible-removal confirmation dialog. Attackers can craft encrypted files with malicious slot identifiers containing bidi overrides or line-separator characters to forge warning text and deceive users during file removal operations.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| jahlives | openssl_encrypt | < 1.4.9 | 1.4.9 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | openssl-encrypt | < 1.4.9 | 1.4.9 | PYSEC-2026-3793 |
References
- GitHub Security Advisory (GHSA-49h2-qmcq-wvvc) vendor-advisory
- VulnCheck Advisory: openssl_encrypt before 1.4.9 Text Injection via Recovery Slot Metadata third-party-advisory