CyberRota Analysis
AI-GeneratedThe vulnerability affects the OpenSSL package, specifically the openssl_encrypt module prior to version 1.4.9, which improperly validates files on portable USB drives, allowing unauthorized files, such as malicious autorun payloads, to be included without detection. Additionally, the use of a constant, source-embedded key derivation function (KDF) salt compromises the encryption key's security, making it susceptible to offline rainbow-table attacks. Organizations using this package, especially those handling sensitive data on removable drives, should prioritize addressing this vulnerability to mitigate potential data breaches.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
openssl_encrypt (pip package openssl-encrypt) before 1.4.9 contains two weaknesses in the portable USB drive feature, whose threat model treats the removable drive as untrusted (attacker with physical write access). USBDriveCreator._verify_integrity_file only validates files listed in the manifest, so files added to the drive — including a root-level autorun payload — are not detected and integrity verification still passes. Additionally, a globally constant, source-embedded KDF salt (_LEGACY_FIXED_SALT) is used to derive the drive encryption key for any drive lacking a per-drive salt file, defeating precomputation resistance and enabling an offline rainbow-table attack.
Related CVEs
Other vulnerabilities affecting the same vendor(s)