CVE-2026-81696

Katalog CVE

CVSS 3.3 · Low EPSS 0,25%

Kerentanan Improper Output Neutralization for Logs pada jahlives openssl encrypt. Skor CVSS 3.1 3.3 (Low) menurut vulncheck.com.

Deskripsi (NVD)

openssl_encrypt versions before 1.4.9 fail to sanitize terminal control characters in file metadata printed by the info command. Attackers can craft malicious files containing escape sequences to repaint terminal output and forge verification information displayed to users.

Advisory KUTIM-CSIRT

• Peringatan Keamanan: Rekapitulasi 66 Kerentanan pada Paket Python openssl_encrypt 5 Sep 2026

Rincian

Terbit di NVD

27 Agustus 2026

Terakhir diubah

1 September 2026

Status NVD

Analyzed

CVSS 3.1

3.3 (Low), sumber vulncheck.com
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-117: Improper Output Neutralization for Logs

EPSS (30 hari)

0,25% peluang dieksploitasi; lebih tinggi dari 15,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-539p-fxf4-7fv8 advisory vendor
• https://www.vulncheck.com/advisories/openssl-encrypt-before-1.4.9-terminal-injection-via-info-command advisory pihak ketiga