CyberRota Analysis
AI-GeneratedVersions of the OpenSSL pip package openssl-encrypt up to 1.4.8 expose the keyserver bearer token in cleartext within debug logs due to inadequate sanitization. This vulnerability can lead to credential leakage, potentially compromising security if logs are accessed by unauthorized users. Organizations using affected versions should prioritize upgrading to 1.4.9 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
openssl_encrypt (pip package openssl-encrypt) versions <= 1.4.8 do not redact the keyserver bearer token passed as the positional argument to 'keyserver set-token' in the --debug argv dump, because sanitize_argv_for_debug fails to sanitize it. As a result the token is printed in cleartext to stderr under --debug (even without --unsafe-show-secrets), persisting the credential in logs and terminal history. Fixed in 1.4.9.
Related CVEs
Other vulnerabilities affecting the same vendor(s)