EUVD-2026-60109
GHSA-8p4p-w6mq-4grq
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Exploitation requires pre-existing code execution to set a process environment variable, so AV:L and PR:H; only integrity of encrypted data is lost, so C:N/I:H/A:N.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
openssl_encrypt versions before 1.4.0 contain an authentication bypass vulnerability in CamelliaCipher that disables HMAC tag generation and verification when the PYTEST_CURRENT_TEST environment variable is set. Attackers with code execution can set this environment variable to produce unauthenticated ciphertext and bypass integrity protection on encrypted data.
AnalysisAI
Integrity-protection bypass in the jahlives openssl_encrypt Python library (all versions before 1.4.0) lets an attacker who can influence the process environment silently disable HMAC authentication in the CamelliaCipher code path. When the PYTEST_CURRENT_TEST environment variable is present, the library skips generating and verifying HMAC tags, so ciphertext is produced and accepted without integrity protection, enabling undetected tampering of encrypted data. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires two concrete conditions: (1) the application must use the CamelliaCipher code path of openssl_encrypt at a version below 1.4.0, and (2) the attacker must be able to set the PYTEST_CURRENT_TEST environment variable in the target process's environment, which presupposes pre-existing code execution or control of the process launch/environment. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The published CVSS 4.0 base score is 9.3 (Critical) with vector AV:N/AC:L/PR:N/UI:N/VC:H/VI:H/VA:H, but that scoring conflicts with the description: exploitation explicitly requires an attacker who already has code execution or the ability to set an environment variable in the target process, which is not a remote, unauthenticated, network-reachable condition - this discrepancy should be verified against the vendor advisory rather than taken at face value. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who gains code execution or environment control on a host running an application built on openssl_encrypt sets PYTEST_CURRENT_TEST in the process environment; the CamelliaCipher path then encrypts without an HMAC tag and decrypts without verification. The attacker can subsequently forge or tamper with encrypted records and have them accepted as authentic, defeating the integrity guarantee. … |
| Remediation | Primary fix: upgrade openssl_encrypt to version 1.4.0 or later, which is the vendor-released patched version per GHSA-rvc2-5jxq-gpcj. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all systems and applications using jahlives openssl_encrypt versions prior to 1.4.0 and determine whether the PYTEST_CURRENT_TEST environment variable exists or could be set in production or development environments. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Openssl Encrypt
View allArbitrary native code execution in the jahlives openssl_encrypt Python package (all versions before 1.4.0) arises from i
Sandbox escape in the openssl_encrypt Python library (jahlives) before 1.4.0 lets attacker-supplied plugin code break ou
Insecure PRNG import in the jahlives openssl_encrypt Python package (all versions before 1.4.0) places Python's non-cryp
Authentication bypass in the openssl_encrypt Python library (versions before 1.4.0) lets attackers who can tamper with c
Cryptographic shared-secret disclosure in the openssl_encrypt Python library (maintainer 'jahlives') before 1.4.0 lets a
Sandbox escape leading to remote code execution affects openssl_encrypt (the jahlives Python package) in all versions be
Sandbox escape in the openssl_encrypt Python library (jahlives) before 1.4.0 allows attacker-supplied plugins to run wit
Authentication bypass in the jahlives openssl_encrypt library (all versions before 1.4.0) lets remote unauthenticated at
Weak cryptographic key derivation in the openssl_encrypt Python library (all versions before 1.4.0) stems from its key-n
Arbitrary code execution in jahlives openssl_encrypt before 1.4.0 stems from an inconsistent sandbox: the runtime Plugin
Audit-trail corruption and a security-control race condition in the Python library openssl_encrypt (by jahlives) before
Sensitive-token exposure in openssl_encrypt (the jahlives Python package, pip 'openssl-encrypt') before 1.4.0 stems from
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today