Description

openssl_encrypt versions before 1.4.0 expose passwords passed via the --password CLI argument in process listings accessible to all system users. Attackers can read process arguments through ps aux or /proc/[pid]/cmdline to retrieve plaintext passwords and keystore passwords.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.5",
  "pubDate": "2026-08-17T11:16:41.690Z",
  "pubdate": "2026-08-17T11:16:41.690Z",
  "executiveSummary": "An information disclosure vulnerability exists in openssl_encrypt versions before 1.4.0.\nThe vulnerability involves the insecure handling of sensitive authentication material passed via command-line interface arguments.\nSpecifically, passwords supplied through the --password CLI argument are exposed directly within system process listings.\nLocal system users can leverage standard utilities to read process command-line arguments and retrieve plaintext passwords and keystore passwords.\nThe impact of this vulnerability includes the unauthorized exposure of cryptographic credentials, potentially leading to unauthorized decryption, keystore compromise, and lateral movement within compromised hosts.\nAttackers require local system access with permissions to execute monitoring commands or read pseudo-filesystem process entries.\nNo advanced exploitation requirements or privileges are necessary beyond standard user-level access to inspect active system processes.",
  "technicalDetails": "The root cause of this vulnerability lies in the design implementation of the command-line interface argument parsing mechanism in openssl_encrypt prior to version 1.4.0.\nWhen operators pass sensitive parameters such as encryption keys or keystore passwords using the --password CLI argument, the application exposes these values in cleartext as part of the process argument vector (argv).\nOn Unix-like operating systems, the kernel exposes process execution arguments through virtual filesystem interfaces, specifically via /proc/[pid]/cmdline, as well as through standard process status utilities such as ps aux.\nThe vulnerable component is the argument handling and parameter ingestion routine of the openssl_encrypt utility in affected versions prior to 1.4.0.\nExploitation occurs locally and does not require network exposure, authentication to a remote service, or elevated root privileges.\nAny standard, unprivileged system user capable of executing system monitoring commands or directly reading the procfs entry of the target process can harvest the exposed plaintext credentials.\nThe attack flow proceeds as follows: 1) An administrator or automated script invokes openssl_encrypt with the --password argument containing a sensitive plaintext password. 2) The operating system instantiates the process and writes the full command-line argument string into the process memory space and kernel process table. 3) An attacker executing a command like ps aux or reading /proc/[pid]/cmdline observes the active process and extracts the plaintext password associated with the execution. 4) The attacker leverages the recovered password to access encrypted data payloads or compromise protected keystores."
}