Search

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

    Related vulnerabilities

    PYSEC-2026-3792

    Vulnerability from pysec - Published: 2026-08-27 17:20 - Updated: 2026-09-03 10:37
    VLAI
    Details

    openssl_encrypt (pip package openssl-encrypt) versions 1.4.8 and earlier store an mTLS client private key in cleartext within a world-readable (0644) SharedPreferences file via the desktop GUI's Settings screen 'combined certificate and private key' PEM field. A local attacker with file system access can read the exposed private key. Version 1.4.9 writes the PEM to a dedicated 0600 file, keeps only its path in SharedPreferences, and migrates/scrubs existing cleartext values.

    Severity
    5.5 (Medium)
    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
    Impacted products
    Name purl
    openssl-encrypt pkg:pypi/openssl-encrypt
    Aliases
    To clipboard 

    {
  "affected": [
    {
      "ecosystem_specific": {},
      "package": {
        "ecosystem": "PyPI",
        "name": "openssl-encrypt",
        "purl": "pkg:pypi/openssl-encrypt"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.4.9"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.2.2",
        "0.2.3",
        "0.2.4",
        "0.2.5",
        "0.2.6",
        "0.3.0",
        "0.3.1",
        "0.3.2",
        "0.3.3",
        "0.4.0",
        "0.4.1",
        "0.4.2",
        "0.4.3",
        "0.4.4",
        "0.5.0",
        "0.5.1",
        "0.5.3",
        "0.6.0rc1",
        "0.7.0rc2",
        "0.7.1",
        "0.7.2",
        "0.8.0",
        "0.8.1",
        "0.8.2",
        "0.9.2",
        "1.0.0",
        "1.0.1",
        "1.0.2",
        "1.0.3",
        "1.1.0",
        "1.2.0",
        "1.2.1",
        "1.3.0",
        "1.3.1",
        "1.3.2",
        "1.3.3",
        "1.3.4",
        "1.3.5",
        "1.4.0",
        "1.4.0b3",
        "1.4.0b4",
        "1.4.0b5",
        "1.4.0b6",
        "1.4.0b7",
        "1.4.0b8",
        "1.4.1",
        "1.4.1rc2",
        "1.4.2",
        "1.4.4",
        "1.4.5",
        "1.4.6",
        "1.4.7",
        "1.4.8"
      ]
    }
  ],
  "aliases": [
    "CVE-2026-81683",
    "GHSA-r8gw-6hfj-98jw"
  ],
  "details": "openssl_encrypt (pip package openssl-encrypt) versions 1.4.8 and earlier store an mTLS client private key in cleartext within a world-readable (0644) SharedPreferences file via the desktop GUI\u0027s Settings screen \u0027combined certificate and private key\u0027 PEM field. A local attacker with file system access can read the exposed private key. Version 1.4.9 writes the PEM to a dedicated 0600 file, keeps only its path in SharedPreferences, and migrates/scrubs existing cleartext values.",
  "id": "PYSEC-2026-3792",
  "modified": "2026-09-03T10:37:17.944158Z",
  "published": "2026-08-27T17:20:57.810Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-r8gw-6hfj-98jw"
    },
    {
      "type": "ADVISORY",
      "url": "https://www.vulncheck.com/advisories/openssl-encrypt-before-1.4.9-plaintext-private-key-storage"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}