Em resumo
- CVE-2026-81683 é uma vulnerabilidade MÉDIO (CVSS 5.5) que afeta openssl-encrypt, openssl encrypt (jahlives).
- Chance de exploração nos próximos 30 dias (EPSS): 0.07%, maior que 0.04% das vulnerabilidades.
- Correção: atualize para 1.4.9 ou posterior.
Description
openssl_encrypt (pip package openssl-encrypt) versions 1.4.8 and earlier store an mTLS client private key in cleartext within a world-readable (0644) SharedPreferences file via the desktop GUI's Settings screen 'combined certificate and private key' PEM field. A local attacker with file system access can read the exposed private key. Version 1.4.9 writes the PEM to a dedicated 0600 file, keeps only its path in SharedPreferences, and migrates/scrubs existing cleartext values.
NVD description
openssl_encrypt (pip package openssl-encrypt) versions 1.4.8 and earlier store an mTLS client private key in cleartext within a world-readable (0644) SharedPreferences file via the desktop GUI's Settings screen 'combined certificate and private key' PEM field. A local attacker with file system access can read the exposed private key. Version 1.4.9 writes the PEM to a dedicated 0600 file, keeps only its path in SharedPreferences, and migrates/scrubs existing cleartext values.
Mais vulnerabilidades de openssl-encrypt
Ver tudo →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free