CVE-2026-81681

Katalog CVE

CVSS 4.6 · Medium EPSS 0,17%

Kerentanan Missing Encryption of Sensitive Data pada jahlives openssl encrypt. Skor CVSS 3.1 4.6 (Medium) menurut vulncheck.com.

Deskripsi (NVD)

openssl_encrypt (pip package openssl-encrypt) versions <= 1.4.8 advertise a portable USB workspace as an 'Encrypted USB Workspace' with AES-256-GCM encryption and write a marker declaring the workspace encrypted, but the workspace directory is actually stored in cleartext and the derived encryption key is never applied to it. A user who trusts the branding and places files in the workspace leaves them unencrypted on the removable media, so an attacker with physical access to the media can read the sensitive files. Fixed in 1.4.9, which seals the workspace into an authenticated AES-256-GCM vault.

Advisory KUTIM-CSIRT

• Peringatan Keamanan: Rekapitulasi 66 Kerentanan pada Paket Python openssl_encrypt 5 Sep 2026

Rincian

Terbit di NVD

27 Agustus 2026

Terakhir diubah

2 September 2026

Status NVD

Analyzed

CVSS 3.1

4.6 (Medium), sumber vulncheck.com
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-311: Missing Encryption of Sensitive Data

EPSS (30 hari)

0,17% peluang dieksploitasi; lebih tinggi dari 6,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-2jv6-qqfm-m46m advisory vendor
• https://www.vulncheck.com/advisories/openssl-encrypt-before-1.4.9-false-encryption-via-cleartext-storage advisory pihak ketiga