CVE-2026-81704

Katalog CVE

CVSS 7.5 · High EPSS 0,27%

Kerentanan Use of Password Hash With Insufficient Computational Effort pada jahlives openssl encrypt. Skor CVSS 3.1 7.5 (High) menurut vulncheck.com.

Deskripsi (NVD)

openssl_encrypt versions before 1.4.9 contain a weak key derivation vulnerability in the D-Bus CryptoService.EncryptFile handler that uses unstretched SHA-256 instead of Argon2id. Attackers can perform offline password guessing against encrypted files roughly six to seven orders of magnitude faster than documented protection by exploiting the missing key stretching and hash rounds.

Advisory KUTIM-CSIRT

• Peringatan Keamanan: Rekapitulasi 66 Kerentanan pada Paket Python openssl_encrypt 5 Sep 2026

Rincian

Terbit di NVD

27 Agustus 2026

Terakhir diubah

3 September 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-916: Use of Password Hash With Insufficient Computational Effort

EPSS (30 hari)

0,27% peluang dieksploitasi; lebih tinggi dari 18,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-v9r6-grch-fxw7 advisory vendor
• https://www.vulncheck.com/advisories/openssl-encrypt-before-1.4.9-weak-key-derivation-via-d-bus advisory pihak ketiga