Skip to content

Commit a23860a

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-h3m5-p59h-x88p GHSA-h45m-mgcp-q388 GHSA-vfgx-5q85-58q3
1 parent 913ea61 commit a23860a

3 files changed

Lines changed: 177 additions & 0 deletions

File tree

‎advisories/github-reviewed/2026/03/GHSA-h3m5-p59h-x88p/GHSA-h3m5-p59h-x88p.json‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-h3m5-p59h-x88p",
4+
"modified": "2026-03-31T23:42:17Z",
5+
"published": "2026-03-31T23:42:17Z",
6+
"aliases": [],
7+
"summary": "openssl-encrypt has visible password in process list via --password CLI argument",
8+
"details": "### Summary\n\nPasswords passed via the `--password` / `-p` CLI argument in `openssl_encrypt/modules/crypt_cli_subparser.py` at **lines 150-154** are visible to any user on the system via `ps aux` or `/proc/[pid]/cmdline`.\n\n### Affected Code\n\n```python\nsubparser.add_argument(\n \"--password\", \"-p\",\n help=\"Password (will prompt if not provided, or use CRYPT_PASSWORD environment variable)\",\n)\n```\n\nSimilarly, `--keystore-password` exposes the keystore password.\n\n### Impact\n\nOn multi-user systems, any user can observe the encryption password by listing processes. The `CRYPT_PASSWORD` environment variable alternative is also visible via `/proc/[pid]/environ` (though with slightly restricted access).\n\n### Recommended Fix\n\n- Document the security implications prominently\n- Recommend interactive prompting (already supported) as the secure default\n- Consider supporting password file descriptors (`--password-fd`) or reading from stdin\n- Consider marking the argument as deprecated in favor of interactive prompting\n\n### Fix\n\nFixed in commit `e78a366` on branch `releases/1.4.x` — added --password-file and --password-fd arguments; added OPENSSL_ENCRYPT_PASSWORD env var support; --password now emits deprecation warning.",
9+
"severity": [
10+
{
11+
"type": "CVSS_V4",
12+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U"
13+
}
14+
],
15+
"affected": [
16+
{
17+
"package": {
18+
"ecosystem": "PyPI",
19+
"name": "openssl-encrypt"
20+
},
21+
"ranges": [
22+
{
23+
"type": "ECOSYSTEM",
24+
"events": [
25+
{
26+
"introduced": "0"
27+
},
28+
{
29+
"fixed": "1.4.0"
30+
}
31+
]
32+
}
33+
]
34+
}
35+
],
36+
"references": [
37+
{
38+
"type": "WEB",
39+
"url": "https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-h3m5-p59h-x88p"
40+
},
41+
{
42+
"type": "WEB",
43+
"url": "https://github.com/jahlives/openssl_encrypt/commit/e78a3666e4592f3538adaaa6be8f5f04356174db"
44+
},
45+
{
46+
"type": "PACKAGE",
47+
"url": "https://github.com/jahlives/openssl_encrypt"
48+
}
49+
],
50+
"database_specific": {
51+
"cwe_ids": [
52+
"CWE-256"
53+
],
54+
"severity": "MODERATE",
55+
"github_reviewed": true,
56+
"github_reviewed_at": "2026-03-31T23:42:17Z",
57+
"nvd_published_at": null
58+
}
59+
}

‎advisories/github-reviewed/2026/03/GHSA-h45m-mgcp-q388/GHSA-h45m-mgcp-q388.json‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-h45m-mgcp-q388",
4+
"modified": "2026-03-31T23:41:26Z",
5+
"published": "2026-03-31T23:41:26Z",
6+
"aliases": [],
7+
"summary": "openssl-encrypt: TOTP rate limiter is in-memory only — not shared across workers, lost on restart",
8+
"details": "## Severity: HIGH\n\n### Summary\n\nThe TOTP brute-force rate limiter in `openssl_encrypt_server/modules/pepper/totp.py` at **lines 47-98** uses an in-memory `defaultdict(list)` as a class variable.\n\n### Affected Code\n\n```python\nclass TOTPRateLimiter:\n def __init__(self, ...):\n self.attempts: Dict[str, List[datetime]] = defaultdict(list)\n self.lockouts: Dict[str, datetime] = {}\n\nclass TOTPService:\n _rate_limiter = TOTPRateLimiter() # Class variable, in-memory only\n```\n\n### Impact\n\n1. Rate limit state is **not shared** across multiple server instances/workers — an attacker can distribute attempts\n2. All rate limit state is **lost on server restart** — allows immediate retry\n3. In multi-worker deployments, each worker has independent rate limit state\n\n### Recommended Fix\n\n- Use Redis or the database for rate limit state storage\n- Or use a shared-memory approach for multi-worker deployments\n- At minimum, persist lockout state to survive restarts\n\n### Fix\n\nFixed in commit `2749bc0` on branch `releases/1.4.x` — added abstract RateLimitBackend with InMemoryBackend and DatabaseBackend implementations; defaults to DatabaseBackend when DB available.",
9+
"severity": [
10+
{
11+
"type": "CVSS_V4",
12+
"score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"
13+
}
14+
],
15+
"affected": [
16+
{
17+
"package": {
18+
"ecosystem": "PyPI",
19+
"name": "openssl-encrypt"
20+
},
21+
"ranges": [
22+
{
23+
"type": "ECOSYSTEM",
24+
"events": [
25+
{
26+
"introduced": "0"
27+
},
28+
{
29+
"fixed": "1.4.0"
30+
}
31+
]
32+
}
33+
]
34+
}
35+
],
36+
"references": [
37+
{
38+
"type": "WEB",
39+
"url": "https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-h45m-mgcp-q388"
40+
},
41+
{
42+
"type": "WEB",
43+
"url": "https://github.com/jahlives/openssl_encrypt/commit/2749bc0949b34a5921a35fb4a3f1856fc51916de"
44+
},
45+
{
46+
"type": "PACKAGE",
47+
"url": "https://github.com/jahlives/openssl_encrypt"
48+
}
49+
],
50+
"database_specific": {
51+
"cwe_ids": [
52+
"CWE-770"
53+
],
54+
"severity": "CRITICAL",
55+
"github_reviewed": true,
56+
"github_reviewed_at": "2026-03-31T23:41:26Z",
57+
"nvd_published_at": null
58+
}
59+
}

‎advisories/github-reviewed/2026/03/GHSA-vfgx-5q85-58q3/GHSA-vfgx-5q85-58q3.json‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-vfgx-5q85-58q3",
4+
"modified": "2026-03-31T23:43:06Z",
5+
"published": "2026-03-31T23:43:06Z",
6+
"aliases": [],
7+
"summary": "openssl-encrypt has non-cryptographic PRNG used for steganography pixel selection",
8+
"details": "### Summary\n\nThe `generate_pseudorandom_sequence()` function in `openssl_encrypt/plugins/steganography/core/utils.py` at **lines 89-91** uses Python's `random` module (Mersenne Twister) for steganographic pixel/sample selection.\n\n### Affected Code\n\n```python\nrandom.seed(seed)\nsequence = random.sample(range(max_value), min(length, max_value))\nreturn sequence\n```\n\nAdditionally, the steganography password is stored as a plain Python string (not `SecureBytes`) and only 8 bytes (64 bits) of the SHA-256 hash are used for the seed, reducing effective security to 64 bits.\n\n### Impact\n\nThe Mersenne Twister's state can be recovered from approximately 624 outputs. An attacker who knows or guesses the password can predict the PRNG sequence and determine exactly which pixels contain hidden data, potentially extracting the hidden data without the password.\n\n### Recommended Fix\n\n- Use HMAC-DRBG or `secrets` module for cryptographically secure pixel selection\n- Use full 32-byte SHA-256 output as seed material\n- Store the password in `SecureBytes` instead of a plain string\n\n### Fix\n\nFixed in commit `09e96e0` on branch `releases/1.4.x` — replaced random.seed(hash(password)) with HMAC-SHA256 based CSPRNG (Fisher-Yates shuffle) and numpy Generator with HMAC-derived seeds across all steganography format modules.",
9+
"severity": [
10+
{
11+
"type": "CVSS_V4",
12+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U"
13+
}
14+
],
15+
"affected": [
16+
{
17+
"package": {
18+
"ecosystem": "PyPI",
19+
"name": "openssl-encrypt"
20+
},
21+
"ranges": [
22+
{
23+
"type": "ECOSYSTEM",
24+
"events": [
25+
{
26+
"introduced": "0"
27+
},
28+
{
29+
"fixed": "1.4.0"
30+
}
31+
]
32+
}
33+
]
34+
}
35+
],
36+
"references": [
37+
{
38+
"type": "WEB",
39+
"url": "https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-vfgx-5q85-58q3"
40+
},
41+
{
42+
"type": "WEB",
43+
"url": "https://github.com/jahlives/openssl_encrypt/commit/09e96e090417d34d2f533f6810d3cd4f77810101"
44+
},
45+
{
46+
"type": "PACKAGE",
47+
"url": "https://github.com/jahlives/openssl_encrypt"
48+
}
49+
],
50+
"database_specific": {
51+
"cwe_ids": [
52+
"CWE-330"
53+
],
54+
"severity": "MODERATE",
55+
"github_reviewed": true,
56+
"github_reviewed_at": "2026-03-31T23:43:06Z",
57+
"nvd_published_at": null
58+
}
59+
}

0 commit comments

Comments
 (0)