Threats affecting pkg:github/jahlives/openssl_encrypt

openssl_encrypt versions before 1.4.0 contain an authentication bypass vulnerability in pqc.py where AES-GCM decryption failures trigger fallback to unauthenticated AES-CTR mode. Attackers can modify ciphertext in transit to bypass integrity verification and perform bit-flipping attacks without detection.

openssl_encrypt versions before 1.4.0 fail to apply sandbox restrictions in the default process isolation mode for plugin execution. Attackers can execute malicious plugins with unrestricted access to the filesystem, network, subprocess execution, and all Python modules.

openssl_encrypt versions before 1.4.0 contain hardcoded default JWT signing secrets in config.py that pass validation checks. Attackers with access to source code can forge valid JWT tokens for any client_id to gain authenticated access to keyserver and telemetry APIs.

openssl_encrypt versions before 1.4.0 use HKDF with no salt and static info parameter in key normalization functions, reducing entropy extraction and determinism. Attackers can exploit predictable key derivation with identical inputs to weaken cryptographic security against multi-target attacks.

openssl_encrypt before 1.4.0 imports Python's non-cryptographic 'random' module (Mersenne Twister PRNG) at line 15 of openssl_encrypt/modules/pqc.py. No direct calls to random.* were present in the code, so no cryptographic operation is currently affected; however, the import creates a hazard that future code could inadvertently use random.randint() instead of a cryptographically secure alternative (secrets/os.urandom), producing predictable values since the Mersenne Twister state can be recovered from approximately 624 outputs. Fixed by removing the import in 1.4.0.

openssl_encrypt versions before 1.4.0 contain a path traversal vulnerability in the _is_safe_path method where the plugin_id parameter is not sanitized before constructing the plugin config directory path. Attackers can declare a malicious plugin_id containing path traversal sequences like '../' to access arbitrary directories outside the intended plugin directory.

openssl_encrypt versions before 1.4.0 contain a sandbox bypass vulnerability where the plugin sandbox fails to restrict alternative file access methods like pathlib.Path and io.open. Attackers can import pathlib or io modules to read and write arbitrary files, completely bypassing the restricted_open file access controls.

openssl_encrypt versions before 1.4.0 contain an insecure default configuration that trusts the entire RFC 1918 private address space in IntegrityProxyConfig trusted_proxies. Attackers on private networks can forge client certificate headers to bypass mTLS authentication when ProxyAuth validation is relaxed or modified.

CVE-2026-74881 affects jahlives openssl_encrypt versions before 1.4.0, where the Cross-Origin Resource Sharing (CORS) policy is configured permissively with a wildcard allow_origins and allow_credentials set to true. This misconfiguration allows attackers to craft malicious websites that can make authenticated cross-origin requests to the API on behalf of users who visit these sites.

CVE-2026-74878 is a critical vulnerability in jahlives openssl_encrypt versions before 1.4.0. The vulnerability arises from an in-memory rate limiter used for TOTP brute-force protection that is not shared across server workers and resets on server restart. This allows attackers to bypass rate limiting by distributing authentication attempts across multiple server instances or retrying immediately after a restart.

A vulnerability in jahlives openssl_encrypt versions before 1.4.0 allows authenticated clients to revoke keys belonging to other clients due to missing ownership verification in the revoke_key method. This authorization bypass can be exploited by providing a valid ML-DSA signature, enabling attackers to revoke arbitrary keys.

A critical vulnerability (CVE-2026-74876) exists in jahlives openssl_encrypt versions before 1.4.0. The flaw is in the PublicKeyBundle.from_dict() function, which creates key bundles from untrusted data without verifying cryptographic signatures. This allows attackers to encrypt data using attacker-controlled public keys, potentially leaking secrets.

CVE-2026-74875 is a critical vulnerability in the jahlives openssl_encrypt library versions before 1.4.0. When the jsonschema library is not installed, the software silently skips JSON schema validation, allowing malformed metadata to be accepted. Attackers can exploit this by removing the jsonschema package or supplying unknown metadata format versions to bypass schema checks and process malicious data.