CyberRota Analysis
AI-GeneratedOpenSSL versions prior to 1.4.9 are vulnerable due to a failure to properly redact file passwords in debug output when supplied using certain short and long option formats. This oversight allows cleartext passwords to be exposed in stderr, which can be accessed by anyone with visibility into the output, including terminal logs and CI job logs. Organizations using affected versions of OpenSSL should prioritize this vulnerability to mitigate the risk of unauthorized password disclosure.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
openssl-encrypt before 1.4.9 fails to redact the file password in its --debug argv dump when the password is supplied via bundled short-option spellings (e.g. -apHunter2) or abbreviated long-option spellings (e.g. --passw). The sanitizer only recognized exact option names, --option=value forms, and tokens starting with -p, so these spellings bypass the redaction chokepoint and the cleartext password is written to stderr. Anyone with access to that output (terminal scrollback, merged 2>&1 output, CI job logs, or the GUI's persistent debug log) can recover the password.
Related CVEs
Other vulnerabilities affecting the same vendor(s)