Em resumo
- CVE-2026-74889 é uma vulnerabilidade CRÍTICO (CVSS 9.8) que afeta openssl-encrypt, openssl encrypt (jahlives).
- Chance de exploração nos próximos 30 dias (EPSS): 0.35%, maior que 28.4% das vulnerabilidades.
- Correção: atualize para 1.4.0 ou posterior.
Description
openssl_encrypt versions before 1.4.0 use HKDF with no salt and static info parameter in key normalization functions, reducing entropy extraction and determinism. Attackers can exploit predictable key derivation with identical inputs to weaken cryptographic security against multi-target attacks.
NVD description
openssl_encrypt versions before 1.4.0 use HKDF with no salt and static info parameter in key normalization functions, reducing entropy extraction and determinism. Attackers can exploit predictable key derivation with identical inputs to weaken cryptographic security against multi-target attacks.
Mais vulnerabilidades de openssl-encrypt
Ver tudo →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free