CVE-2026-81717: Improper Verification of Cryptographic Signature in jahlives openssl_encrypt

The vulnerability affects the openssl_encrypt package before version 1.4.9. It involves two main weaknesses in the portable USB drive feature: first, the integrity verification function USBDriveCreator._verify_integrity_file validates only files listed in the manifest, ignoring any additional files added to the drive, which could include malicious autorun payloads. Second, the use of a fixed, source-embedded KDF salt (_LEGACY_FIXED_SALT) for drives without a per-drive salt undermines precomputation resistance, allowing attackers to perform offline rainbow-table attacks to recover encryption keys. These issues compromise the security assumptions of treating removable drives as untrusted and physically accessible by attackers.

An attacker with physical write access to a USB drive can add unauthorized files that bypass integrity checks, potentially enabling execution of malicious payloads. The use of a fixed KDF salt allows attackers to precompute rainbow tables to recover encryption keys offline, compromising the confidentiality of encrypted data on the drive. This significantly weakens the security guarantees of the portable USB drive feature, exposing users to data tampering and data disclosure risks.

A fix is available in versions 1.4.9 and later of the openssl_encrypt package. Users should upgrade to version 1.4.9 or newer to address these vulnerabilities. Until upgraded, users should avoid relying on the portable USB drive feature for security-sensitive use cases and treat removable drives as untrusted. Patch status is confirmed by the affectedVersions data indicating fixes in versions >=1.4.9.