Description

openssl_encrypt (pip package openssl-encrypt) versions <= 1.4.8 advertise a portable USB workspace as an 'Encrypted USB Workspace' with AES-256-GCM encryption and write a marker declaring the workspace encrypted, but the workspace directory is actually stored in cleartext and the derived encryption key is never applied to it. A user who trusts the branding and places files in the workspace leaves them unencrypted on the removable media, so an attacker with physical access to the media can read the sensitive files. Fixed in 1.4.9, which seals the workspace into an authenticated AES-256-GCM vault.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.6",
  "pubDate": "2026-08-27T17:20:57.453Z",
  "pubdate": "2026-08-27T17:20:57.453Z",
  "executiveSummary": "The openssl-encrypt Python package, specifically versions 1.4.8 and below, suffers from a critical cryptographic implementation flaw where data stored in the 'Encrypted USB Workspace' is maintained in cleartext rather than being encrypted as advertised.\nThe vulnerability involves a failure to apply the derived AES-256-GCM encryption key to the filesystem, despite the software creating a marker file that falsely declares the directory as encrypted.\nThis creates a deceptive security posture, leading users to store sensitive data on removable media with the false belief that it is protected. An attacker with physical access to the media can trivially bypass the intended security controls and access all data contained within the workspace without needing any cryptographic keys or credentials.\nThe risk is severe, as it leads to total compromise of data confidentiality for users relying on the tool for transit encryption. Exploitation requires no advanced technical skills, only physical access to the removable storage device to read the cleartext contents.",
  "technicalDetails": "The root cause of the vulnerability resides in the core function openssl_encrypt, where the library fails to integrate the intended AES-256-GCM cryptographic primitive into the file write operations for the portable USB workspace.\nWhile the package initializes a directory structure and writes a marker indicating that the workspace is secured, the actual implementation logic skips the encryption layer entirely. The data is written to the underlying storage media in its original, plaintext format.\nThe attack flow is straightforward: A user utilizes the vulnerable package to create an 'Encrypted USB Workspace' and populates it with sensitive files. The application performs standard file I/O operations instead of streaming the data through the AES-GCM cipher block. Because the encryption process is bypassed, the files remain readable by any standard OS file explorer or forensic tool.\nAn attacker possessing the physical USB media requires no authentication, privilege elevation, or network connectivity to exploit this flaw. They simply mount the device and access the directory path directly. The vulnerability persists across all OS platforms supported by the package.\nPost-exploitation, the impact is a complete loss of confidentiality. The failure to apply the AES-256-GCM vault mechanism negates the primary security value proposition of the library, leaving data susceptible to unauthorized extraction, exfiltration, and forensic analysis.\nThis vulnerability is effectively a 'broken-cryptography-by-design' issue, where the metadata suggests an authenticated vault exists, but the storage backend remains unprotected. Users are misled by the package's output branding, and there is no secondary check or integrity validation performed by the application that would alert the user to the failure of the encryption routine during file creation or modification."
}