{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/openssl-encrypt--1.4.8/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.3,"id":"CVE-2026-81690"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["openssl-encrypt","openssl_encrypt (\u003c 1.4.9)","openssl_encrypt (\u003c= 1.4.8, 1.5.x)","openssl-encrypt (\u003c= 1.4.8)"],"_cs_severities":["high"],"_cs_tags":["supply-chain","code-execution","python"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThe openssl-encrypt Python package (versions prior to 1.4.9) contains a critical symlink-following vulnerability in its verify-usb utility. The flaw arises from inconsistent handling of symbolic links during the directory scan process compared to the file verification stage. Specifically, the utility uses rglob() to enumerate drive contents, which treats symlinks as standard directories. Meanwhile, the verification logic uses O_NOFOLLOW, which only protects the final path component.\u003c/p\u003e\n\u003cp\u003eAn attacker with physical access to a removable media device can exploit this by replacing a legitimate tool-tree directory with a symlink pointing to an attacker-controlled directory. This malicious copy contains identical files alongside a crafted .pyc file located in a \u003cstrong\u003epycache\u003c/strong\u003e folder. CPython prioritizes loading these byte-identical .pyc files over recompilation. Because the scan fails to enumerate the malicious files within the symlinked structure, the verification tool reports a PASSED status, tricking the victim into executing the untrusted portable install.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in arbitrary code execution on the victim's host system when the portable software is launched. This primarily impacts users relying on the openssl-encrypt package for verifying integrity of removable media. The vulnerability affects both the 1.4.x and 1.5.x branches of the software.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade the openssl-encrypt package to version 1.4.9 or later immediately to patch the symlink handling flaw.\u003c/li\u003e\n\u003cli\u003eImplement strict removable media usage policies to prevent unauthorized physical access to devices used with high-integrity verification tools.\u003c/li\u003e\n\u003cli\u003eAudit logs for instances of verify-usb tool usage and ensure the software binary paths remain within expected, read-only directories on the host, rather than relying solely on the portable media's internal check.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-27T19:13:54Z","date_published":"2026-08-27T19:11:13Z","id":"https://feed.craftedsignal.io/briefs/2026-08-openssl-encrypt-symlink-vuln/","summary":"The openssl-encrypt Python package before version 1.4.9 is vulnerable to a symlink-following flaw in its verify-usb functionality, allowing attackers with physical access to removable drives to achieve arbitrary code execution via crafted __pycache__ files.","title":"Arbitrary Code Execution in openssl-encrypt via Symlink Following","url":"https://feed.craftedsignal.io/briefs/2026-08-openssl-encrypt-symlink-vuln/"},{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-81702"}],"_cs_exploited":true,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["openssl_encrypt (\u003c 1.4.9)","openssl-encrypt (\u003c= 1.4.8)","openssl-encrypt (\u003c 1.4.9)"],"_cs_severities":["critical"],"_cs_tags":["cryptographic-vulnerability","credential-theft","openssl_encrypt","cve-2026-81689","vulnerability","cryptography","denial-of-service","cve-2026-81699"],"_cs_type":"threat","_cs_vendors":["OpenSSL","openssl_encrypt","openssl-encrypt"],"content_html":"\u003cp\u003eThe openssl_encrypt library, specifically versions prior to 1.4.9, contains a critical vulnerability (CVE-2026-81702) in its identity management mechanism. When the library loads identity configurations from the 'identity.json' file, it fails to perform necessary re-derivation and validation of identity fingerprints. This design flaw allows an attacker with local file write access to substitute legitimate public keys with attacker-controlled keys within the identity store. Because the fingerprint validation is skipped or improperly performed, the library continues to associate the manipulated identity store with the original, expected fingerprint. This enables silent key substitution where systems perform encryption using attacker-provided keys while signature verification routines falsely report successful validation, creating significant risks for data interception, spoofing, and man-in-the-middle scenarios within applications relying on this library.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for the complete bypass of cryptographic identity verification. An attacker can intercept and decrypt sensitive communications or spoof legitimate entities by presenting a substituted public key that appears valid to the affected software. This poses a high risk of data breach and loss of integrity for any infrastructure or application utilizing openssl_encrypt for key-based authentication or encryption.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade openssl_encrypt to version 1.4.9 or higher across all affected applications immediately.\u003c/li\u003e\n\u003cli\u003eAudit file system permissions for 'identity.json' files to ensure they are write-protected and accessible only by the service process owner.\u003c/li\u003e\n\u003cli\u003eScan environments for the presence of the 'identity.json' file to identify software components that rely on the vulnerable library implementation.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-27T21:10:02Z","date_published":"2026-08-27T19:09:25Z","id":"https://feed.craftedsignal.io/briefs/2026-08-openssl-encrypt-identity-vuln/","summary":"The openssl_encrypt library before 1.4.9 is vulnerable to key substitution attacks due to improper fingerprint validation when loading identities from local identity.json files.","title":"CVE-2026-81702 Key Substitution in openssl_encrypt","url":"https://feed.craftedsignal.io/briefs/2026-08-openssl-encrypt-identity-vuln/"}],"language":"en","title":"CraftedSignal Threat Feed - Openssl-Encrypt (\u003c= 1.4.8)","version":"https://jsonfeed.org/version/1.1"}