An attacker with physical access to a removable media device can exploit this by replacing a legitimate tool-tree directory with a symlink pointing to an attacker-controlled directory. This malicious copy contains identical files alongside a crafted .pyc file located in a pycache folder. CPython prioritizes loading these byte-identical .pyc files over recompilation. Because the scan fails to enumerate the malicious files within the symlinked structure, the verification tool reports a PASSED status, tricking the victim into executing the untrusted portable install.

Impact

Successful exploitation results in arbitrary code execution on the victim's host system when the portable software is launched. This primarily impacts users relying on the openssl-encrypt package for verifying integrity of removable media. The vulnerability affects both the 1.4.x and 1.5.x branches of the software.

Recommendation

• Upgrade the openssl-encrypt package to version 1.4.9 or later immediately to patch the symlink handling flaw.
• Implement strict removable media usage policies to prevent unauthorized physical access to devices used with high-integrity verification tools.
• Audit logs for instances of verify-usb tool usage and ensure the software binary paths remain within expected, read-only directories on the host, rather than relying solely on the portable media's internal check.

Impact

Successful exploitation allows for the complete bypass of cryptographic identity verification. An attacker can intercept and decrypt sensitive communications or spoof legitimate entities by presenting a substituted public key that appears valid to the affected software. This poses a high risk of data breach and loss of integrity for any infrastructure or application utilizing openssl_encrypt for key-based authentication or encryption.

Recommendation

• Upgrade openssl_encrypt to version 1.4.9 or higher across all affected applications immediately.
• Audit file system permissions for 'identity.json' files to ensure they are write-protected and accessible only by the service process owner.
• Scan environments for the presence of the 'identity.json' file to identify software components that rely on the vulnerable library implementation.