Description

openssl_encrypt versions before 1.4.0 contain a vulnerability in PublicKeyBundle.from_dict() that creates key bundles from untrusted data without verifying signatures. Attackers can call from_dict() followed by to_identity() without signature verification to encrypt data using attacker-controlled public keys, leaking secrets.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-17T11:16:42.073Z",
  "pubdate": "2026-08-17T11:16:42.073Z",
  "executiveSummary": "A critical vulnerability exists in openssl_encrypt versions prior to 1.4.0 within the PublicKeyBundle.from_dict() function.\nThe flaw involves improper handling of untrusted data during key bundle initialization, specifically failing to enforce cryptographic signature verification.\nThe impact of this vulnerability allows unauthorized actors to instantiate key bundles using attacker-controlled public keys.\nBy chaining the insecure initialization method with subsequent calls to to_identity(), an adversary can successfully manipulate the encryption mechanism.\nThis capability leads directly to the unauthorized encryption of sensitive data under the control of the attacker, resulting in severe confidentiality breaches and leakage of application secrets.\nThe affected systems include openssl_encrypt versions below 1.4.0.\nExploitation requires the ability to supply untrusted input to the PublicKeyBundle.from_dict() routine, enabling attackers to execute cryptographic operations with arbitrary, unverified public keys without prior authentication or elevated privileges.",
  "technicalDetails": "The root cause of the vulnerability resides in the PublicKeyBundle.from_dict() method within the openssl_encrypt codebase for versions prior to 1.4.0.\nThe vulnerable component processes serialized dictionary data representing public key bundles without validating their underlying cryptographic signatures.\nConsequently, the application blindly accepts and trusts the provided data structure, incorporating arbitrary public keys into the active cryptographic context.\nThe exploitation method follows a specific attack flow: first, the adversary supplies a crafted payload containing malicious or attacker-controlled public keys to the PublicKeyBundle.from_dict() function.\nBecause signature verification is omitted, the method successfully constructs the key bundle object.\nSecond, the attacker invokes the to_identity() function on the resulting object.\nThis execution path forces the cryptographic module to operate using the attacker-controlled public keys injected during the initial step.\nAs a payload behavior, the encryption operations are redirected or intercepted, allowing the adversary to encrypt target plaintext using their own keys.\nThe post-exploitation impact is characterized by the exposure and leakage of sensitive application secrets, as data encrypted under attacker-controlled keys can be decrypted or monitored by the adversary.\nAuthentication and privilege requirements are minimal or non-existent, depending on how exposed the from_dict() function is to external or untrusted data sources within the application architecture.\nNetwork exposure depends on the integration of openssl_encrypt within network-facing services that process remote untrusted dictionaries."
}