CyberRota Analysis
AI-GeneratedOpenSSL versions up to 1.4.8 are vulnerable due to a flaw in the configuration file resolution that allows the Tk GUI to read and write sensitive KDF settings from the current working directory instead of the user's home directory. This misconfiguration can be exploited by an attacker to introduce a malicious crypt_settings.json file, significantly weakening encryption and facilitating offline brute-force attacks. Organizations using affected versions should prioritize upgrading to version 1.4.9 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
openssl_encrypt (pip package openssl-encrypt) versions <= 1.4.8 contain a CWD-relative configuration file resolution flaw in crypt_settings.py, where CONFIG_FILE (originally the absolute per-user path ~/.crypt_settings.json) is reassigned at line 84 to the bare relative name 'crypt_settings.json'. As a result, the legacy Tk GUI's SettingsTab reads and writes KDF settings from crypt_settings.json in the process launch (current working) directory instead of the user's home directory. An attacker who plants a malicious crypt_settings.json (e.g. sha256:1 with all memory-hard KDFs disabled) can silently downgrade encryption performed in that GUI session to roughly one hash round, bypassing the weak-KDF preflight and enabling offline brute-force attacks against the resulting ciphertext. Fixed in 1.4.9.