CyberRota Analysis
AI-GeneratedOpenSSL versions prior to 1.4.9 are vulnerable to namespace collisions in the IdentityStore, allowing attackers to create hidden contact entries that remain undetectable until the legitimate identity is deleted. This can lead to silent key substitution for encrypted files, posing a risk to data integrity and confidentiality. Organizations using affected OpenSSL versions should prioritize patching to mitigate potential exploitation risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
openssl_encrypt before 1.4.9 fails to prevent namespace collisions between own identities and contacts in IdentityStore, allowing attackers to create shadowed contact entries invisible until the corresponding own identity is deleted. When the own identity is deleted, the shadowed contact becomes visible and resolves to the attacker's keys, enabling silent key substitution for encrypted files.
Related CVEs
Other vulnerabilities affecting the same vendor(s)