CVE-2026-81701

Katalog CVE

CVSS 9.8 · Critical EPSS 0,43%

Kerentanan Improper Verification of Cryptographic Signature pada jahlives openssl encrypt. Skor CVSS 3.1 9.8 (Critical) menurut vulncheck.com.

Deskripsi (NVD)

openssl_encrypt versions before 1.4.9 use a denylist to identify trusted built-in plugins, allowing unsigned plugins in top-level plugins/ directories and unknown subdirectories to bypass signature verification. Attackers can place malicious unsigned plugins following documented installation paths to achieve arbitrary code execution in the CLI process with access to passwords and cryptographic keys.

Advisory KUTIM-CSIRT

• Peringatan Keamanan: Rekapitulasi 66 Kerentanan pada Paket Python openssl_encrypt 5 Sep 2026

Rincian

Terbit di NVD

27 Agustus 2026

Terakhir diubah

1 September 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-347: Improper Verification of Cryptographic Signature

EPSS (30 hari)

0,43% peluang dieksploitasi; lebih tinggi dari 35,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-wxx9-p55f-wm34 advisory vendor
• https://www.vulncheck.com/advisories/openssl-encrypt-before-1.4.9-arbitrary-code-execution-via-unsigned-plugin advisory pihak ketiga