CyberRota Analysis
AI-GeneratedOpenSSL versions prior to 1.4.0 are vulnerable due to a non-standard PBKDF2 key derivation method that utilizes only one iteration per call, compromising the strength of password protection for legacy encrypted files. This flaw allows attackers to more easily crack passwords, posing a significant risk to the confidentiality of sensitive data. Organizations using affected versions of OpenSSL should prioritize upgrading to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
openssl_encrypt versions before 1.4.0 use a non-standard PBKDF2 key derivation construction with iterations=1 per call in an outer loop, creating a KDF whose security properties have not been formally analyzed. Attackers can exploit this weakened key derivation to more efficiently crack passwords protecting legacy encrypted files compared to standard PBKDF2 implementations.
Related CVEs
Other vulnerabilities affecting the same vendor(s)