The vulnerability in jahlives openssl_encrypt versions before 1.4.0 arises from the use of a non-standard PBKDF2 key derivation construction. Specifically, the implementation uses iterations=1 per call in an outer loop, creating a key derivation function with unverified security properties. This flawed design weakens the cryptographic strength of password protection on legacy encrypted files, enabling attackers to crack passwords more efficiently than with standard PBKDF2 implementations.

Attackers can exploit the weakened key derivation function to more efficiently recover passwords protecting legacy encrypted files. This compromises the confidentiality of data encrypted using the affected versions of openssl_encrypt. There is no indication of privilege escalation, denial of service, or other impacts beyond the reduced cryptographic strength of password protection.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is provided. Users should monitor vendor communications for updates and consider avoiding use of affected legacy encrypted files or migrating to versions 1.4.0 or later once confirmed.