CyberRota Analysis
AI-GeneratedOpenSSL versions prior to 1.4.0 are vulnerable to an authentication bypass in the CamelliaCipher, which allows attackers with code execution to disable HMAC tag generation and verification by manipulating the PYTEST_CURRENT_TEST environment variable. This flaw enables the creation of unauthenticated ciphertext, compromising the integrity of encrypted data. Organizations using affected versions of OpenSSL should prioritize patching to mitigate potential data integrity risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
openssl_encrypt versions before 1.4.0 contain an authentication bypass vulnerability in CamelliaCipher that disables HMAC tag generation and verification when the PYTEST_CURRENT_TEST environment variable is set. Attackers with code execution can set this environment variable to produce unauthenticated ciphertext and bypass integrity protection on encrypted data.
Related CVEs
Other vulnerabilities affecting the same vendor(s)