EUVD-2026-60092
GHSA-jxvv-jp94-p77v
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Exploitation requires local shell access and reading process args via /proc or ps; PR:L for any local account; confidentiality-only impact with no integrity or availability consequence.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
4DescriptionCVE.org
openssl_encrypt versions before 1.4.0 expose passwords passed via the --password CLI argument in process listings accessible to all system users. Attackers can read process arguments through ps aux or /proc/[pid]/cmdline to retrieve plaintext passwords and keystore passwords.
AnalysisAI
Password exposure in openssl_encrypt before version 1.4.0 allows any local system user to capture plaintext encryption and keystore passwords by reading process argument listings. When operators pass credentials via the --password or -p CLI flags, those values appear verbatim in /proc/[pid]/cmdline and ps aux output on Linux/Unix multi-user systems. No public exploit is identified at time of analysis, though exploitation requires only standard POSIX utilities universally available on Linux; the CVSS 4.0 vector's AV:N designation appears miscalibrated - actual attack surface is local, meaningfully limiting real-world risk.
Technical ContextAI
openssl_encrypt is a Python-based CLI encryption wrapper distributed via pip (package: openssl-encrypt, CPE: cpe:2.3:a:jahlives:openssl_encrypt:*:*:*:*:*:*:*:*). The root cause is CWE-214 (Insertion of Sensitive Information into Externally-Accessible File/Directory). On Linux, process argument arrays (argv) are exposed by the kernel through /proc/[pid]/cmdline, which is world-readable by default, and through tools like ps aux. When a program receives secrets via argv rather than through secure channels (stdin prompts, file descriptors, or restricted environment variables), any co-resident local user can observe them. The vulnerable code is in openssl_encrypt/modules/crypt_cli_subparser.py at lines 150-154, where --password / -p is defined as a standard argparse argument with no masking, deprecation, or secure-input mechanism. The --keystore-password argument is similarly affected. The CRYPT_PASSWORD environment variable alternative is also noted as exposed via /proc/[pid]/environ, though with marginally tighter OS-level access controls than argv.
RemediationAI
Upgrade openssl_encrypt to version 1.4.0 via pip install --upgrade openssl-encrypt. The fix, introduced in commit e78a3666e4592f3538adaaa6be8f5f04356174db on the releases/1.4.x branch, adds secure alternatives including --password-file and --password-fd arguments and introduces the OPENSSL_ENCRYPT_PASSWORD environment variable; the legacy --password argument now emits a deprecation warning. If immediate patching is not feasible, use interactive password prompting by omitting the --password flag entirely - the tool will prompt securely via stdin, which does not expose the secret in argv. As a secondary workaround, set CRYPT_PASSWORD as an environment variable; note this is slightly more restricted than argv but still visible via /proc/[pid]/environ to root and to the process owner on some configurations, so it is not a complete mitigation. Do not embed --password values in shell scripts, cron jobs, or CI/CD pipeline definitions. Advisory: https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-h3m5-p59h-x88p.
More in Openssl Encrypt
View allArbitrary native code execution in the jahlives openssl_encrypt Python package (all versions before 1.4.0) arises from i
Fingerprint-verification spoofing in jahlives openssl_encrypt before 1.4.9 lets attackers embed ANSI escape sequences in
Sandbox escape in the openssl_encrypt Python library (jahlives) before 1.4.0 allows attacker-supplied plugins to run wit
Arbitrary code execution in jahlives openssl_encrypt before 1.4.0 stems from an inconsistent sandbox: the runtime Plugin
Authentication bypass in the jahlives openssl_encrypt library (all versions before 1.4.0) lets remote unauthenticated at
Authentication brute-force protection can be bypassed in jahlives openssl_encrypt before 1.4.0 because the TOTP rate lim
Sandbox escape in the openssl_encrypt Python library (jahlives) before 1.4.0 lets attacker-supplied plugin code break ou
Cryptographic shared-secret disclosure in the openssl_encrypt Python library (maintainer 'jahlives') before 1.4.0 lets a
Sandbox escape leading to remote code execution affects openssl_encrypt (the jahlives Python package) in all versions be
Arbitrary code execution in openssl_encrypt (the jahlives Python encryption utility) before 1.4.9 allows an attacker-sup
Arbitrary code execution in jahlives openssl_encrypt before 1.4.9 stems from a flawed plugin trust model that uses a den
Sensitive-token exposure in openssl_encrypt (the jahlives Python package, pip 'openssl-encrypt') before 1.4.0 stems from
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today