CyberRota Analysis
AI-GeneratedOpenSSL versions prior to 1.4.9 are vulnerable due to a weak key derivation mechanism in the D-Bus CryptoService.EncryptFile handler, which uses unstretched SHA-256 instead of the more secure Argon2id. This flaw allows attackers to conduct offline password guessing attacks on encrypted files with significantly reduced effort, compromising the confidentiality of sensitive data. Organizations using affected versions of OpenSSL should prioritize updating to mitigate the risk of unauthorized access to encrypted information.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
openssl_encrypt versions before 1.4.9 contain a weak key derivation vulnerability in the D-Bus CryptoService.EncryptFile handler that uses unstretched SHA-256 instead of Argon2id. Attackers can perform offline password guessing against encrypted files roughly six to seven orders of magnitude faster than documented protection by exploiting the missing key stretching and hash rounds.
Related CVEs
Other vulnerabilities affecting the same vendor(s)