Description
openssl_encrypt (pip package openssl-encrypt) versions <= 1.4.8 do not redact the keyserver bearer token passed as the positional argument to 'keyserver set-token' in the --debug argv dump, because sanitize_argv_for_debug fails to sanitize it. As a result the token is printed in cleartext to stderr under --debug (even without --unsafe-show-secrets), persisting the credential in logs and terminal history. Fixed in 1.4.9.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| jahlives | openssl_encrypt | < 1.4.9 | 1.4.9 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | openssl-encrypt | < 1.4.9 | 1.4.9 | PYSEC-2026-3964 |
References
- GitHub Security Advisory (GHSA-jqqp-pf9j-889j) vendor-advisory
- VulnCheck Advisory: openssl_encrypt before 1.4.9 Credential Exposure via Debug Output third-party-advisory