CyberRota Analysis
AI-GeneratedOpenSSL versions prior to 1.4.6 are vulnerable due to a key derivation flaw in the sequential XOR composition mode, which allows attackers to bypass memory-hard key derivation methods. This vulnerability enables offline password cracking at significantly faster rates, equivalent to SHA-256, rather than the intended KDF cost. Organizations using affected OpenSSL versions should prioritize updates to mitigate the risk of compromised cryptographic security.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
openssl_encrypt versions before 1.4.6 contain a key derivation flaw in sequential XOR composition mode where the last stage cancels out during key generation. When configured with a single KDF and no prior hashing stage, attackers can bypass memory-hard key derivation and perform offline password cracking at SHA-256 speed instead of the configured KDF cost.
Related CVEs
Other vulnerabilities affecting the same vendor(s)