CyberRota Analysis
AI-GeneratedThe OpenSSL package versions up to 1.4.8 are vulnerable as they falsely advertise an 'Encrypted USB Workspace' while storing the workspace directory in cleartext, leaving sensitive files exposed to anyone with physical access. This flaw can lead to unauthorized access to confidential data, making it critical for users and organizations relying on this encryption feature to upgrade to version 1.4.9 or later. Prioritization is essential for those managing sensitive information on removable media to mitigate the risk of data breaches.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
openssl_encrypt (pip package openssl-encrypt) versions <= 1.4.8 advertise a portable USB workspace as an 'Encrypted USB Workspace' with AES-256-GCM encryption and write a marker declaring the workspace encrypted, but the workspace directory is actually stored in cleartext and the derived encryption key is never applied to it. A user who trusts the branding and places files in the workspace leaves them unencrypted on the removable media, so an attacker with physical access to the media can read the sensitive files. Fixed in 1.4.9, which seals the workspace into an authenticated AES-256-GCM vault.
Related CVEs
Other vulnerabilities affecting the same vendor(s)