The vulnerability in jahlives openssl_encrypt versions before 1.4.0 stems from the use of a broken or risky cryptographic algorithm. Specifically, it employs a non-standard PBKDF2 key derivation construction with iterations=1 per call in an outer loop, creating a key derivation function whose security properties have not been formally analyzed. This weakened key derivation enables attackers to more efficiently crack passwords protecting legacy encrypted files compared to standard PBKDF2 implementations. The CVSS 4.0 base score is 8.7, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality.

Attackers can exploit the weakened key derivation function to more efficiently crack passwords protecting legacy encrypted files. This compromises the confidentiality of encrypted data. There is no indication of impact on integrity or availability. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation has been documented. Users should monitor vendor communications for updates and consider avoiding use of affected versions for sensitive data encryption until a fix is available.