CyberRota Analysis
AI-GeneratedOpenSSL versions prior to 1.4.9 are vulnerable due to a failure to properly re-derive and validate fingerprints when loading identities from identity.json, allowing attackers to substitute legitimate public keys with their own. This critical vulnerability enables silent key substitution, where encryption is performed using the attacker's keys while signature verification remains valid, potentially compromising the confidentiality and integrity of encrypted communications. Organizations using affected OpenSSL versions should prioritize immediate updates to mitigate the risk of unauthorized access and data breaches.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
openssl_encrypt before 1.4.9 fails to re-derive and validate fingerprints when loading identities from identity.json, allowing attackers to substitute public keys in identity stores. Attackers can replace legitimate public keys with their own while maintaining the claimed fingerprint, enabling silent key substitution where encryption uses attacker keys and signature verification appears valid.
Related CVEs
Other vulnerabilities affecting the same vendor(s)