EUVD-2026-60098
GHSA-r654-xcxm-6jpc
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible unauthenticated health endpoint; no integrity or availability impact; high confidentiality loss from potential credential and infrastructure detail exposure.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
4DescriptionCVE.org
openssl_encrypt versions before 1.4.0 contain an information disclosure vulnerability in the /ready endpoint that returns full database exception strings to unauthenticated callers. Attackers can trigger database errors to extract sensitive information including hostnames, IP addresses, connection parameters, and potentially credentials from exception messages.
AnalysisAI
Information disclosure in the openssl-encrypt Python pip package (jahlives/openssl_encrypt, all versions before 1.4.0) allows any unauthenticated network caller to extract sensitive database infrastructure details by hitting the /ready health-check endpoint. The endpoint returns raw Python exception strings - including database hostnames, IP addresses, port numbers, driver version, and potentially credentials embedded in connection strings - whenever a database error is triggered. No public exploit code has been identified at time of analysis, but the attack requires only a standard HTTP client and no special conditions against default deployments.
Technical ContextAI
The vulnerability is rooted in openssl_encrypt_server/server.py at lines 159-175, where a bare except block catches database exceptions and serializes them directly into the HTTP response via Python's str(e) coercion. This is a textbook instance of CWE-209 (Generation of Error Message Containing Sensitive Information). Python database drivers - such as SQLAlchemy, psycopg2, and pymysql - routinely include full connection DSNs in exception messages, which frequently embed usernames, passwords, hostnames, and ports. The /ready endpoint is a health-check route with no authentication guard, making the disclosure path trivially reachable. The affected package is identified by CPE cpe:2.3:a:jahlives:openssl_encrypt:*:*:*:*:*:*:*:* and is distributed via pip as openssl-encrypt.
RemediationAI
Upgrade to openssl-encrypt version 1.4.0 or later, which resolves the issue by replacing the raw exception string with a generic 'database check failed' message and logging the full exception server-side at WARNING level (patch commit 7aa8787f4de2e9a23f58fca067bb16c4c69d28bb, available at https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-2vhw-q7vh-7xv2). If an immediate upgrade is not feasible, restrict access to the /ready endpoint at the network layer using firewall rules or reverse proxy authentication - note that this may disrupt health-check tooling or orchestration systems that rely on the endpoint without credentials. Do not rely on application-layer fixes without patching, as the root cause is in the server component itself.
More in Openssl Encrypt
View allArbitrary native code execution in the jahlives openssl_encrypt Python package (all versions before 1.4.0) arises from i
Fingerprint-verification spoofing in jahlives openssl_encrypt before 1.4.9 lets attackers embed ANSI escape sequences in
Sandbox escape in the openssl_encrypt Python library (jahlives) before 1.4.0 allows attacker-supplied plugins to run wit
Arbitrary code execution in jahlives openssl_encrypt before 1.4.0 stems from an inconsistent sandbox: the runtime Plugin
Authentication bypass in the jahlives openssl_encrypt library (all versions before 1.4.0) lets remote unauthenticated at
Authentication brute-force protection can be bypassed in jahlives openssl_encrypt before 1.4.0 because the TOTP rate lim
Sandbox escape in the openssl_encrypt Python library (jahlives) before 1.4.0 lets attacker-supplied plugin code break ou
Cryptographic shared-secret disclosure in the openssl_encrypt Python library (maintainer 'jahlives') before 1.4.0 lets a
Sandbox escape leading to remote code execution affects openssl_encrypt (the jahlives Python package) in all versions be
Arbitrary code execution in openssl_encrypt (the jahlives Python encryption utility) before 1.4.9 allows an attacker-sup
Arbitrary code execution in jahlives openssl_encrypt before 1.4.9 stems from a flawed plugin trust model that uses a den
Sensitive-token exposure in openssl_encrypt (the jahlives Python package, pip 'openssl-encrypt') before 1.4.0 stems from
Same weakness CWE-209 – Error Message Information Leak
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today