CyberRota Analysis
AI-GeneratedThe vulnerability affects OpenSSL versions prior to 1.4.9, where the `openssl_encrypt` function does not properly sanitize the email field of imported identity documents. This flaw allows attackers to inject ANSI escape sequences, potentially forging the fingerprint verification line displayed to users, which can lead to successful key substitution attacks. Organizations using affected versions of OpenSSL, particularly those relying on secure email communications or identity verification processes, should prioritize patching this critical vulnerability to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
openssl_encrypt before 1.4.9 fails to sanitize the email field of imported identity documents, allowing attackers to inject ANSI escape sequences that forge the fingerprint verification line displayed to users. Attackers can deliver a crafted identity bundle through normal contact-exchange flows or keyserver responses to manipulate terminal output and display a fraudulent fingerprint, bypassing the out-of-band verification mechanism that protects against key substitution attacks.