CyberRota Analysis
AI-GeneratedThe OpenSSL pip package versions 1.4.8 and earlier are vulnerable due to inadequate sanitization of filenames from untrusted sources, which can lead to misleading output in the verify-usb command. An attacker could exploit this vulnerability to manipulate the display, obscuring actual tampering results by showing a false "PASSED" verdict. Organizations using affected versions should prioritize upgrading to version 1.4.9 or later to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
openssl-encrypt (pip package, versions <= 1.4.8) fails to sanitize filenames read from untrusted drive data (outside the AES-GCM authenticated manifest) before printing them in the verify-usb command's output. An attacker can plant filenames containing terminal cursor-movement and erase-line control bytes that repaint a forged PASSED verdict on screen, masking actual tamper detection. Fixed in 1.4.9 by routing drive-derived names through sanitize_for_display().
Related CVEs
Other vulnerabilities affecting the same vendor(s)