Description

openssl_encrypt before 1.4.9 fails to re-derive and validate fingerprints when loading identities from identity.json, allowing attackers to substitute public keys in identity stores. Attackers can replace legitimate public keys with their own while maintaining the claimed fingerprint, enabling silent key substitution where encryption uses attacker keys and signature verification appears valid.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-27T17:21:00.680Z",
  "pubdate": "2026-08-27T17:21:00.680Z",
  "executiveSummary": "The openssl_encrypt package versions prior to 1.4.9 are susceptible to an identity substitution vulnerability stemming from improper validation of cryptographic identity stores. The core issue lies in the failure to re-derive and verify public key fingerprints when loading data from the identity.json configuration file.\nThis flaw allows an attacker with write access to the identity store to perform a silent key substitution attack. By replacing a legitimate public key with a malicious one while maintaining the original, trusted fingerprint, the attacker can intercept or manipulate encrypted communications.\nThe vulnerability compromises the integrity and authenticity of the key management process. Because the system fails to re-validate the identity upon loading, it trusts the forged key, causing subsequent encryption operations to utilize the attacker's public key. This leads to a total compromise of message confidentiality, as the attacker can decrypt traffic intended for the victim. Furthermore, signature verification may appear valid if the internal validation logic is bypassed by the misaligned fingerprint data. This vulnerability poses a significant risk to systems relying on openssl_encrypt for secure key identity management, as it facilitates man-in-the-middle interceptions without triggering standard security alerts.",
  "technicalDetails": "The vulnerability resides within the identity loading mechanism of openssl_encrypt, specifically in the logic responsible for parsing and initializing identities from identity.json. In versions prior to 1.4.9, the implementation assumes that the stored fingerprint provided in the JSON file is inherently trustworthy and does not perform a secondary cryptographic derivation of the fingerprint directly from the associated public key upon load time.\nThe root cause is a failure in the trust chain verification process. During the initialization phase, the software fetches the identity record, including the public key and its corresponding fingerprint, but lacks a mandatory re-derivation step to ensure the integrity of the binding between the public key and the metadata. This state-loading oversight creates a 'time-of-check to time-of-use' (TOCTOU) discrepancy or, more accurately, an absence of verification.\nThe attack flow proceeds as follows: First, an attacker must gain unauthorized write access to the filesystem where identity.json is stored. Second, the attacker locates a legitimate entry and replaces the legitimate public key (or the entire identity block) with an attacker-controlled public key. Critically, the attacker retains the original, legitimate fingerprint string within the JSON object. Third, when the application performs its next load operation, it reads the modified identity.json. Because the application logic relies on the existing stored fingerprint and skips the costly or complex step of verifying the fingerprint against the provided public key, the malicious identity is ingested into the system's memory as a valid, trusted identity.\nPost-exploitation, any subsequent encryption operations directed toward the affected identity will utilize the attacker’s public key. This allows the attacker to decrypt the resulting ciphertext using their corresponding private key. Additionally, because the application incorrectly validates the identity, signature verification processes may return success, as they rely on the incorrectly loaded identity store to verify signatures, thereby facilitating impersonation attacks and bypassing authentication mechanisms. This flaw affects all deployment scenarios where identity.json is used for key persistence and remains present in all versions before 1.4.9."
}