EUVD-2026-60091
GHSA-ccp9-5g7c-pj86
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Exploitation needs local write access to a site-packages directory (AV:L, PR:L for an unprivileged user), no interaction, and yields full native code execution (C:H/I:H/A:H).
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionCVE.org
openssl_encrypt versions before 1.4.0 contain an arbitrary code execution vulnerability in the Whirlpool hash implementation that uses broad glob patterns to load .so modules without integrity verification. Attackers can place malicious .so files matching the whirlpool*py313*.so pattern in site-packages directories to achieve native code execution when the module is loaded.
AnalysisAI
Arbitrary native code execution in the jahlives openssl_encrypt Python package (all versions before 1.4.0) arises from its Whirlpool hash routine loading .so extension modules via a broad glob pattern without any integrity check. An attacker who can drop a file matching 'whirlpool*py313*.so' into a site-packages directory gets their code executed in-process the moment the hashing module is imported. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to place a file whose name matches the glob pattern 'whirlpool*py313*.so' into one of the directories returned by site.getsitepackages(), and requires the target process to run under CPython 3.13 and to invoke the Whirlpool hash code path in openssl_encrypt (<1.4.0) so the vulnerable loader executes. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The published CVSS 4.0 base of 9.3 with AV:N/AC:L/PR:N/UI:N assumes remote, unauthenticated, no-interaction exploitation, but that conflicts with the actual mechanism: the attacker must already be able to WRITE a malicious .so into a site-packages directory, which is a local filesystem precondition (CWE-426), not a network operation - this discrepancy should be verified against the vendor advisory and likely warrants a lower, locally-scoped score. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A low-privileged local user (or a compromised third-party dependency in the same environment) writes a crafted whirlpool313.so containing malicious init code into a writable site-packages directory. When any application later imports openssl_encrypt and triggers the Whirlpool hash, glob() matches the planted file, importlib loads it, and the attacker's native code runs with the importing process's privileges. … |
| Remediation | Upgrade to the fixed release - Vendor-released patch: openssl-encrypt 1.4.0 (pip install --upgrade openssl-encrypt), which corresponds to upstream commit 963d0d1278b722ea134272f9df65fddcd3e6ab47 on branch releases/1.4.x; the fix adds os.path.realpath() symlink resolution and validates that any discovered .so resides within a known site-packages path before loading. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, conduct a complete inventory of systems and applications using the jahlives openssl_encrypt package to establish scope. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Openssl Encrypt
View allSandbox escape in the openssl_encrypt Python library (jahlives) before 1.4.0 lets attacker-supplied plugin code break ou
Insecure PRNG import in the jahlives openssl_encrypt Python package (all versions before 1.4.0) places Python's non-cryp
Authentication bypass in the openssl_encrypt Python library (versions before 1.4.0) lets attackers who can tamper with c
Cryptographic shared-secret disclosure in the openssl_encrypt Python library (maintainer 'jahlives') before 1.4.0 lets a
Sandbox escape leading to remote code execution affects openssl_encrypt (the jahlives Python package) in all versions be
Sandbox escape in the openssl_encrypt Python library (jahlives) before 1.4.0 allows attacker-supplied plugins to run wit
Authentication bypass in the jahlives openssl_encrypt library (all versions before 1.4.0) lets remote unauthenticated at
Integrity-protection bypass in the jahlives openssl_encrypt Python library (all versions before 1.4.0) lets an attacker
Weak cryptographic key derivation in the openssl_encrypt Python library (all versions before 1.4.0) stems from its key-n
Arbitrary code execution in jahlives openssl_encrypt before 1.4.0 stems from an inconsistent sandbox: the runtime Plugin
Audit-trail corruption and a security-control race condition in the Python library openssl_encrypt (by jahlives) before
Sensitive-token exposure in openssl_encrypt (the jahlives Python package, pip 'openssl-encrypt') before 1.4.0 stems from
Same weakness CWE-426 – Untrusted Search Path
View allShare
External POC / Exploit Code
Leaving vuln.today