CyberRota Analysis
AI-GeneratedOpenSSL versions prior to 1.4.0 are vulnerable due to the importation of Python's non-cryptographic Mersenne Twister PRNG in the `openssl_encrypt` module, which could lead to the unintentional use of predictable random values in future code. While no current cryptographic operations are directly affected, this oversight poses a risk for future implementations that may rely on the non-secure random number generation. Organizations using OpenSSL should prioritize upgrading to version 1.4.0 or later to mitigate this potential vulnerability.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
openssl_encrypt before 1.4.0 imports Python's non-cryptographic 'random' module (Mersenne Twister PRNG) at line 15 of openssl_encrypt/modules/pqc.py. No direct calls to random.* were present in the code, so no cryptographic operation is currently affected; however, the import creates a hazard that future code could inadvertently use random.randint() instead of a cryptographically secure alternative (secrets/os.urandom), producing predictable values since the Mersenne Twister state can be recovered from approximately 624 outputs. Fixed by removing the import in 1.4.0.
Related CVEs
Other vulnerabilities affecting the same vendor(s)