CVE-2026-81705: Insertion of Sensitive Information into Log File in jahlives openssl_encrypt

The jahlives openssl_encrypt utility versions prior to 1.4.9 fail to redact passwords supplied via bundled short-option spellings (e.g., -apHunter2) or abbreviated long-option spellings (e.g., --passw) in the --debug argv dump. The sanitizer responsible for redacting sensitive information only recognizes exact option names, --option=value forms, and tokens starting with -p, which allows these alternative spellings to bypass the redaction chokepoint. Consequently, the cleartext password is written to stderr, terminal scrollback, CI job logs, or the GUI's persistent debug log, exposing the password to anyone with access to these outputs.

Cleartext passwords can be exposed in logs and terminal outputs, potentially allowing unauthorized users with access to these outputs to recover sensitive credentials. This compromises confidentiality and could lead to unauthorized access if the exposed passwords are reused or grant access to critical systems.

A fix is available in jahlives openssl_encrypt version 1.4.9 that addresses this issue by properly redacting passwords supplied via all supported option spellings. Users should upgrade to version 1.4.9 or later to mitigate this vulnerability. Until upgraded, avoid using bundled short-option or abbreviated long-option spellings for passwords in debug mode to reduce exposure risk.