CyberRota Analysis
AI-GeneratedOpenSSL versions prior to 1.4.0 are vulnerable due to a flaw in the PublicKeyBundle.from_dict() function, which allows the creation of key bundles from untrusted data without proper signature verification. This vulnerability enables attackers to encrypt data using malicious public keys, potentially leading to the exposure of sensitive information. Organizations utilizing affected OpenSSL versions should prioritize immediate updates to mitigate this critical risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
openssl_encrypt versions before 1.4.0 contain a vulnerability in PublicKeyBundle.from_dict() that creates key bundles from untrusted data without verifying signatures. Attackers can call from_dict() followed by to_identity() without signature verification to encrypt data using attacker-controlled public keys, leaking secrets.
Related CVEs
Other vulnerabilities affecting the same vendor(s)