jahlives vulnerabilities and threats

CVE-2026-74875 is a critical vulnerability in the jahlives openssl_encrypt library versions before 1.4.0. When the jsonschema library is not installed, the software silently skips JSON schema validation, allowing malformed metadata to be accepted. Attackers can exploit this by removing the jsonschema package or supplying unknown metadata format versions to bypass schema checks and process malicious data.

CVE-2026-74874 is a high-severity vulnerability in jahlives openssl_encrypt versions before 1.4.0. The vulnerability arises from the use of Python's non-cryptographic random module (Mersenne Twister) for steganographic pixel selection in the generate_pseudorandom_sequence function. An attacker who knows the password can recover the internal state of the PRNG from about 624 outputs, allowing prediction of pixel locations containing hidden data, facilitating data extraction.

A vulnerability in jahlives openssl_encrypt versions before 1.4.0 allows sensitive passwords passed via the --password CLI argument to be exposed in process listings. This exposure enables any system user to read plaintext passwords and keystore passwords through standard process inspection tools like ps aux or by accessing /proc/[pid]/cmdline.

CVE-2026-74872 is a critical arbitrary code execution vulnerability in the jahlives openssl_encrypt library versions before 1.4.0. The flaw arises from the Whirlpool hash implementation using broad glob patterns to load .so modules without verifying their integrity. Attackers can exploit this by placing malicious .so files matching the whirlpool*py313*.so pattern in site-packages directories, leading to native code execution when the module loads.

openssl_encrypt versions before 1.4.6 contain a key derivation flaw in sequential XOR composition mode where the last stage cancels out during key generation. When configured with a single KDF and no prior hashing stage, attackers can bypass memory-hard key derivation and perform offline password cracking at SHA-256 speed instead of the configured KDF cost.

openssl_encrypt (pip) versions <= 1.4.7 contain an information exposure vulnerability where the 'hsm fido2-test' and 'hsm onlykey-test' diagnostic commands unconditionally print the full derived hardware pepper as hex to stdout/stderr (crypt_cli.py, handle_hsm_command). The printed value can persist in terminal scrollback, session recordings, or CI logs. Impact is limited because the pepper is derived from a random per-invocation test salt and is salt-bound, so the leaked value cannot be used to decrypt real files. A related plugin issue logged raw prf_data outside the secret-redaction path. Fixed in 1.4.8 (and 1.5.0) by removing the hex dumps and routing plugin debug output through the redaction layer.