CyberRota Analysis
AI-GeneratedOpenSSL versions prior to 1.4.9 are vulnerable to a shell injection flaw in the info command, where untrusted metadata fields are interpolated without proper quoting. This allows attackers to embed shell commands in metadata values, which could be executed if users copy and paste the output into a shell. Organizations using affected OpenSSL versions should prioritize patching to mitigate the risk of potential command execution attacks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
openssl_encrypt versions before 1.4.9 contain a shell injection vulnerability in the info command's reconstructed CLI block that interpolates untrusted metadata fields without quoting. Attackers can craft metadata values like pepper_name containing shell commands that execute when users copy the printed CLI block into a shell.
Related CVEs
Other vulnerabilities affecting the same vendor(s)