openssl-encrypt (PyPI)
Advisories
70
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 1.4.9 or later clears every advisory below that has a fix.
Upgrade commands
pip
pip install --upgrade "openssl-encrypt>=1.4.9"poetry
poetry add "openssl-encrypt>=1.4.9"uv
uv add "openssl-encrypt>=1.4.9"Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| PYSEC-2026-3803 openssl_encrypt before 1.4.9 fails to validate KDF cost parameters in encrypted file metadata and keystore headers, allowing attackers to trigger unbounded… |
High EPSS 0.58% |
< 1.4.9 | 1.4.9 |
| PYSEC-2026-3965 openssl_encrypt before 1.4.9 fails to validate the memory_cost parameter from identity file protection blocks, allowing attackers to trigger out-of-memory… |
Medium EPSS 0.18% |
< 1.4.9 | 1.4.9 |
| PYSEC-2026-3802 openssl_encrypt before 1.4.9 executes untrusted third-party plugins with insufficient controls: the plugin signature policy defaulted to WARN, so an… |
High EPSS 0.44% |
< 1.4.9 | 1.4.9 |
| PYSEC-2026-3801 openssl_encrypt (pip package openssl-encrypt) before 1.4.9 contains two weaknesses in the portable USB drive feature, whose threat model treats the removable… |
Low EPSS 0.12% |
< 1.4.9 | 1.4.9 |
| PYSEC-2026-3800 openssl_encrypt (pip: openssl-encrypt) versions before 1.4.9 contain a path traversal flaw in PluginSandbox._is_safe_path, which authorized file access using a… |
Medium EPSS 0.26% |
< 1.4.9 | 1.4.9 |
| PYSEC-2026-3964 openssl_encrypt (pip package openssl-encrypt) versions <= 1.4.8 do not redact the keyserver bearer token passed as the positional argument to 'keyserver… |
Low EPSS 0.26% |
< 1.4.9 | 1.4.9 |
| PYSEC-2026-3799 openssl_encrypt (pip: openssl-encrypt) versions <= 1.4.8 use suffix-tolerant fingerprint matching in enroll_trust_key when binding a plugin-signing trust… |
High EPSS 0.20% |
< 1.4.9 | 1.4.9 |
| PYSEC-2026-3781 openssl_encrypt before 1.4.9 fails to prevent namespace collisions between own identities and contacts in IdentityStore, allowing attackers to create shadowed… |
Critical EPSS 0.18% |
< 1.4.9 | 1.4.9 |
| PYSEC-2026-3780 openssl-encrypt before 1.4.9 fails to redact the file password in its --debug argv dump when the password is supplied via bundled short-option spellings (e.g. |
High EPSS 0.44% |
< 1.4.9 | 1.4.9 |
| PYSEC-2026-3963 openssl_encrypt versions before 1.4.9 contain a weak key derivation vulnerability in the D-Bus CryptoService.EncryptFile handler that uses unstretched SHA-256… |
High EPSS 0.27% |
< 1.4.9 | 1.4.9 |
| PYSEC-2026-3779 openssl_encrypt versions before 1.4.9 fail to validate encryption status of embedded post-quantum private keys in file metadata. |
Medium EPSS 0.22% |
< 1.4.9 | 1.4.9 |
| PYSEC-2026-3962 openssl_encrypt before 1.4.9 fails to re-derive and validate fingerprints when loading identities from identity.json, allowing attackers to substitute public… |
Critical EPSS 0.19% |
< 1.4.9 | 1.4.9 |
| PYSEC-2026-3778 openssl_encrypt versions before 1.4.9 use a denylist to identify trusted built-in plugins, allowing unsigned plugins in top-level plugins/ directories and… |
Critical EPSS 0.43% |
< 1.4.9 | 1.4.9 |
| PYSEC-2026-3777 openssl_encrypt versions before 1.4.9 contain a signature verification vulnerability in gpg_runner.verify_detached that accepts revoked and expired keys by… |
Critical EPSS 0.35% |
< 1.4.9 | 1.4.9 |
| PYSEC-2026-3961 openssl_encrypt versions before 1.4.9 fail to properly validate key derivation function costs in crafted files, allowing attackers to trigger unbounded memory… |
High EPSS 0.51% |
< 1.4.9 | 1.4.9 |
| PYSEC-2026-3776 openssl_encrypt versions before 1.4.9 contain a shell injection vulnerability in the info command's reconstructed CLI block that interpolates untrusted… |
Critical EPSS 0.43% |
< 1.4.9 | 1.4.9 |
| PYSEC-2026-3775 openssl_encrypt versions before 1.4.9 fail to sanitize terminal control characters in file metadata printed by the info command. |
Low EPSS 0.25% |
< 1.4.9 | 1.4.9 |
| PYSEC-2026-3774 openssl_encrypt versions before 1.4.9 fail to escape attacker-controlled key_id values printed to stderr during decrypt auto-detection. |
Low EPSS 0.25% |
< 1.4.9 | 1.4.9 |
| PYSEC-2026-3960 openssl-encrypt (pip package, versions <= 1.4.8) fails to sanitize filenames read from untrusted drive data (outside the AES-GCM authenticated manifest) before… |
Low EPSS 0.25% |
< 1.4.9 | 1.4.9 |
| PYSEC-2026-3798 openssl_encrypt before 1.4.9 fails to validate the total field from QR JSON payloads before materializing ranges. |
High EPSS 0.49% |
< 1.4.9 | 1.4.9 |
| PYSEC-2026-3797 openssl_encrypt versions before 1.4.9 fail to validate server URLs in login and register_with_email functions, accepting unencrypted http:// URLs and… |
High EPSS 0.27% |
< 1.4.9 | 1.4.9 |
| PYSEC-2026-3796 openssl-encrypt (pip package) before 1.4.9 contains a symlink-following flaw in its verify-usb v2 added-file allowlist scan. |
High EPSS 0.71% |
< 1.4.9 | 1.4.9 |
| PYSEC-2026-3959 openssl_encrypt versions before 1.4.9 derive the remote-pepper wrap key using unsalted HKDF-SHA256 or bare SHA-256 of the password, allowing identical keys… |
High EPSS 0.27% |
< 1.4.9 | 1.4.9 |
| PYSEC-2026-3795 openssl_encrypt versions before 1.4.9 store an unkeyed SHA-256 hash of the plaintext in the cleartext file header metadata. |
High EPSS 0.27% |
< 1.4.9 | 1.4.9 |
| PYSEC-2026-3794 openssl_encrypt 1.4.x before 1.4.9 contains an optional D-Bus crypto service whose org.freedesktop.DBus.Properties.Set method performs neither a polkit… |
Medium EPSS 0.14% |
< 1.4.9 | 1.4.9 |
| PYSEC-2026-3793 openssl_encrypt versions before 1.4.9 fail to sanitize recovery-slot metadata in the desktop GUI, allowing attackers to inject control characters and line… |
Low EPSS 0.25% |
< 1.4.9 | 1.4.9 |
| PYSEC-2026-3958 In openssl_encrypt (pip package openssl-encrypt) versions <= 1.4.8, the desktop GUI passes the steganography password to the CLI child process on the command… |
Medium EPSS 0.17% |
< 1.4.9 | 1.4.9 |
| PYSEC-2026-3792 openssl_encrypt (pip package openssl-encrypt) versions 1.4.8 and earlier store an mTLS client private key in cleartext within a world-readable (0644)… |
High EPSS 0.07% |
< 1.4.9 | 1.4.9 |
| PYSEC-2026-3791 openssl_encrypt (pip package openssl-encrypt) versions <= 1.4.8 advertise a portable USB workspace as an 'Encrypted USB Workspace' with AES-256-GCM encryption… |
Medium EPSS 0.17% |
< 1.4.9 | 1.4.9 |
| PYSEC-2026-3957 openssl_encrypt versions before 1.4.9 fail to authenticate recovery-slot presence in envelope-format encrypted files, allowing attackers to remove recovery… |
Critical EPSS 0.20% |
< 1.4.9 | 1.4.9 |
| PYSEC-2026-3773 openssl_encrypt versions before 1.4.0 contain an authentication bypass vulnerability in pqc.py where AES-GCM decryption failures trigger fallback to… |
Critical EPSS 0.40% |
< 1.4.0 | 1.4.0 |
| PYSEC-2026-3772 openssl_encrypt versions before 1.4.0 contain a critical vulnerability in pqc.py where KEM decapsulation failures silently fall back to simulation mode,… |
Critical EPSS 0.56% |
< 1.4.0 | 1.4.0 |
| PYSEC-2026-3727 openssl_encrypt versions before 1.4.0 contain a sandbox escape vulnerability in IsolatedPluginExecutor that exposes Python type objects in restricted exec()… |
Critical EPSS 0.75% |
< 1.4.0 | 1.4.0 |
| PYSEC-2026-3771 openssl_encrypt versions before 1.4.0 contain a sandbox escape vulnerability in the DangerousPatternVisitor AST analyzer that fails to detect dunder attribute… |
Critical EPSS 0.56% |
< 1.4.0 | 1.4.0 |
| PYSEC-2026-3770 openssl_encrypt versions before 1.4.0 fail to apply sandbox restrictions in the default process isolation mode for plugin execution. |
Critical EPSS 0.68% |
< 1.4.0 | 1.4.0 |
| PYSEC-2026-3769 openssl_encrypt before 1.4.0 contains an authentication bypass vulnerability in the verify_api_token function that accepts any non-empty Bearer token string… |
Critical EPSS 0.66% |
< 1.4.0 | 1.4.0 |
| PYSEC-2026-3768 openssl_encrypt versions before 1.4.0 contain hardcoded default JWT signing secrets in config.py that pass validation checks. |
High EPSS 0.45% |
< 1.4.0 | 1.4.0 |
| PYSEC-2026-3746 openssl_encrypt versions before 1.4.0 contain a hardcoded default secret key in the standalone telemetry server configuration that is used for API key hashing. |
High EPSS 0.51% |
< 1.4.0 | 1.4.0 |
| PYSEC-2026-3767 openssl_encrypt versions before 1.4.0 contain hardcoded database credentials in standalone server configuration files. |
Critical EPSS 0.52% |
< 1.4.0 | 1.4.0 |
| PYSEC-2026-3766 openssl_encrypt versions before 1.4.0 contain an authentication bypass vulnerability in CamelliaCipher that disables HMAC tag generation and verification when… |
Medium EPSS 0.21% |
< 1.4.0 | 1.4.0 |
| PYSEC-2026-3765 openssl_encrypt versions before 1.4.0 use HKDF with no salt and static info parameter in key normalization functions, reducing entropy extraction and… |
Critical EPSS 0.35% |
< 1.4.0 | 1.4.0 |
| PYSEC-2026-3764 openssl_encrypt versions before 1.4.0 use a non-standard PBKDF2 key derivation construction with iterations=1 per call in an outer loop, creating a KDF whose… |
High EPSS 0.27% |
< 1.4.0 | 1.4.0 |
| PYSEC-2026-3745 openssl_encrypt before 1.4.0 imports Python's non-cryptographic 'random' module (Mersenne Twister PRNG) at line 15 of openssl_encrypt/modules/pqc.py. |
Medium EPSS 0.30% |
< 1.4.0 | 1.4.0 |
| PYSEC-2026-3763 openssl_encrypt versions before 1.4.0 contain a plugin sandbox bypass vulnerability where the PluginImportGuard blocks a different set of modules than the AST… |
Critical EPSS 0.68% |
< 1.4.0 | 1.4.0 |
| PYSEC-2026-3762 openssl_encrypt versions before 1.4.0 contain a logging bug in restore_hidden_modules() that logs module counts after clearing, always showing zero restored… |
Low EPSS 0.21% |
< 1.4.0 | 1.4.0 |
| PYSEC-2026-3761 openssl_encrypt versions before 1.4.0 contain a path traversal vulnerability in the _is_safe_path method where the plugin_id parameter is not sanitized before… |
High EPSS 0.44% |
< 1.4.0 | 1.4.0 |
| PYSEC-2026-3760 openssl_encrypt versions before 1.4.0 contain a sandbox bypass vulnerability where the plugin sandbox fails to restrict alternative file access methods like… |
High EPSS 0.48% |
< 1.4.0 | 1.4.0 |
| PYSEC-2026-3744 openssl_encrypt versions before 1.4.0 contain an insecure default configuration that trusts the entire RFC 1918 private address space in IntegrityProxyConfig… |
High EPSS 0.17% |
< 1.4.0 | 1.4.0 |
| PYSEC-2026-3976 openssl_encrypt versions before 1.4.6 contain a key derivation flaw in sequential XOR composition mode where the last stage cancels out during key generation. |
Medium EPSS 0.11% |
< 1.4.6 | 1.4.6 |
| PYSEC-2026-3956 openssl_encrypt (pip) versions <= 1.4.7 contain an information exposure vulnerability where the 'hsm fido2-test' and 'hsm onlykey-test' diagnostic commands… |
Low EPSS 0.26% |
< 1.4.7 | 1.4.7 |
| GHSA-c65f-x25w-62jv openssl-encrypt has CORS wildcard with allow_credentials=True in standalone servers |
Critical EPSS 0.36% |
< 1.4.0 | 1.4.0 |
| GHSA-c65f-x25w-62jv openssl-encrypt has CORS wildcard with allow_credentials=True in standalone servers |
Critical EPSS 0.36% |
< 1.4.0 | 1.4.0 |
| GHSA-4rh7-jwg9-m28m openssl-encrypt accepts refresh tokens as URL query parameters causing token leakage |
Critical EPSS 0.56% |
< 1.4.0 | 1.4.0 |
| GHSA-4rh7-jwg9-m28m openssl-encrypt accepts refresh tokens as URL query parameters causing token leakage |
Critical EPSS 0.56% |
< 1.4.0 | 1.4.0 |
| GHSA-2vhw-q7vh-7xv2 openssl-encrypt's readiness endpoint leaks database error details to unauthenticated callers |
High EPSS 0.44% |
< 1.4.0 | 1.4.0 |
| GHSA-2vhw-q7vh-7xv2 openssl-encrypt's readiness endpoint leaks database error details to unauthenticated callers |
High EPSS 0.44% |
< 1.4.0 | 1.4.0 |
| GHSA-hvc7-763r-4f3h openssl-encrypt has no owner verification on key revocation — any client can revoke any key |
High EPSS 0.45% |
< 1.4.0 | 1.4.0 |
| GHSA-hvc7-763r-4f3h openssl-encrypt has no owner verification on key revocation — any client can revoke any key |
High EPSS 0.45% |
< 1.4.0 | 1.4.0 |
| GHSA-8h88-gxp3-j7pg openssl-encrypt's unverified key bundle from_dict() + to_identity() path allows encryption to attacker keys |
Critical EPSS 0.35% |
< 1.4.0 | 1.4.0 |
| GHSA-8h88-gxp3-j7pg openssl-encrypt's unverified key bundle from_dict() + to_identity() path allows encryption to attacker keys |
Critical EPSS 0.35% |
< 1.4.0 | 1.4.0 |
| GHSA-425g-fjhq-5h92 openssl-encrypt silently skips schema validation when jsonschema library is not installed |
Critical EPSS 0.27% |
< 1.4.0 | 1.4.0 |
| GHSA-425g-fjhq-5h92 openssl-encrypt silently skips schema validation when jsonschema library is not installed |
Critical EPSS 0.27% |
< 1.4.0 | 1.4.0 |
| GHSA-vfgx-5q85-58q3 openssl-encrypt has non-cryptographic PRNG used for steganography pixel selection |
High EPSS 0.44% |
< 1.4.0 | 1.4.0 |
| GHSA-vfgx-5q85-58q3 openssl-encrypt has non-cryptographic PRNG used for steganography pixel selection |
High EPSS 0.44% |
< 1.4.0 | 1.4.0 |
| GHSA-h3m5-p59h-x88p openssl-encrypt has visible password in process list via --password CLI argument |
Medium EPSS 0.32% |
< 1.4.0 | 1.4.0 |
| GHSA-h3m5-p59h-x88p openssl-encrypt has visible password in process list via --password CLI argument |
Medium EPSS 0.32% |
< 1.4.0 | 1.4.0 |
| GHSA-h45m-mgcp-q388 openssl-encrypt: TOTP rate limiter is in-memory only — not shared across workers, lost on restart |
Critical EPSS 0.75% |
< 1.4.0 | 1.4.0 |
| GHSA-h45m-mgcp-q388 openssl-encrypt: TOTP rate limiter is in-memory only — not shared across workers, lost on restart |
Critical EPSS 0.75% |
< 1.4.0 | 1.4.0 |
| GHSA-j48q-4c78-rhf9 openssl-encrypt: Dynamic .so loading for Whirlpool uses broad glob pattern without integrity verification |
Critical EPSS 0.68% |
< 1.4.0 | 1.4.0 |
| GHSA-j48q-4c78-rhf9 openssl-encrypt: Dynamic .so loading for Whirlpool uses broad glob pattern without integrity verification |
Critical EPSS 0.68% |
< 1.4.0 | 1.4.0 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor