CyberRota Analysis
AI-GeneratedOpenSSL versions 1.4.8 and earlier are vulnerable due to the insecure storage of mTLS client private keys in a world-readable SharedPreferences file, allowing local attackers with file system access to read the sensitive information. The impact includes potential unauthorized access to secure communications and data breaches. Organizations using affected versions should prioritize upgrading to version 1.4.9 or later to mitigate this high-severity vulnerability.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
openssl_encrypt (pip package openssl-encrypt) versions 1.4.8 and earlier store an mTLS client private key in cleartext within a world-readable (0644) SharedPreferences file via the desktop GUI's Settings screen 'combined certificate and private key' PEM field. A local attacker with file system access can read the exposed private key. Version 1.4.9 writes the PEM to a dedicated 0600 file, keeps only its path in SharedPreferences, and migrates/scrubs existing cleartext values.
Related CVEs
Other vulnerabilities affecting the same vendor(s)