Description
openssl_encrypt versions before 1.4.9 fail to validate encryption status of embedded post-quantum private keys in file metadata. Attackers can craft files with unencrypted embedded PQC keys that decrypt under any password, bypassing authentication and producing attacker-chosen plaintext with false integrity verification.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| jahlives | openssl_encrypt | < 1.4.9 | 1.4.9 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | openssl-encrypt | < 1.4.9 | 1.4.9 | PYSEC-2026-3779 |
References
- GitHub Security Advisory (GHSA-qqfq-g2cv-j7v3) vendor-advisory
- VulnCheck Advisory: openssl_encrypt before 1.4.9 Authentication Bypass via Unencrypted PQC Key third-party-advisory