Description

openssl_encrypt versions before 1.4.9 contain a weak key derivation vulnerability in the D-Bus CryptoService.EncryptFile handler that uses unstretched SHA-256 instead of Argon2id. Attackers can perform offline password guessing against encrypted files roughly six to seven orders of magnitude faster than documented protection by exploiting the missing key stretching and hash rounds.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-27T17:21:00.993Z",
  "pubdate": "2026-08-27T17:21:00.993Z",
  "executiveSummary": "The D-Bus CryptoService component within openssl_encrypt versions prior to 1.4.9 suffers from a critical cryptographic deficiency regarding key derivation.\nThe vulnerability stems from the implementation of an insufficiently robust hashing mechanism for password-based encryption, specifically utilizing unstretched SHA-256 instead of the industry-standard Argon2id.\nThis flaw significantly reduces the computational cost of brute-force and dictionary attacks.\nAn attacker capable of obtaining the encrypted file can execute offline password-guessing attempts with a performance improvement of six to seven orders of magnitude compared to what would be expected with proper key stretching.\nThe vulnerability represents a severe risk to data confidentiality, as it enables the rapid derivation of the master key from relatively low-entropy passwords, effectively bypassing the intended security posture of the encrypted files.\nThe exploitation does not require active interaction with the live service; it is purely an offline process once the target encrypted payload is intercepted or accessed by an unauthorized entity.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper implementation of the key derivation function (KDF) within the D-Bus CryptoService.EncryptFile handler. Instead of employing a modern, memory-hard, and computationally expensive KDF such as Argon2id, the application relies on a single pass of the SHA-256 hash algorithm.\nSHA-256 is a fast cryptographic hash function designed for data integrity verification rather than password hashing. When used as a KDF without salt or iteration-based stretching, it permits extremely high-throughput hashing operations. Attackers leveraging GPUs or specialized hardware (ASICs/FPGAs) can compute millions of SHA-256 hashes per second per core.\nThe attack flow begins when an attacker gains access to a file encrypted by the vulnerable version of openssl_encrypt. Because the file was encrypted using unstretched SHA-256, the entropy of the resulting key is strictly bound by the entropy of the user's password without the mitigation provided by work factors. The lack of iterations means the key derivation process is computationally trivial.\nIn a secure configuration, Argon2id provides resistance against hardware-accelerated attacks through tunable memory, time, and parallelism parameters. By omitting these, the CryptoService fails to increase the 'cost' for an attacker to verify potential password guesses. Consequently, the time required to perform an exhaustive search of the password space is reduced by a factor of approximately 10^6 to 10^7.\nThe vulnerable component is identified as the D-Bus CryptoService.EncryptFile function handler. All versions prior to 1.4.9 are confirmed to contain this implementation flaw. Exploitation is offline, meaning the attacker requires no authentication or privileges against the system once the encrypted data is obtained. The payload behavior is passive; the attacker simply performs high-speed cracking against the intercepted ciphertext to recover the plaintext key or the underlying data.\nPost-exploitation, the confidentiality of the encrypted files is entirely compromised. If the password lacks significant length or complexity, the attacker can recover the key almost instantaneously, allowing for the decryption of any data processed by the vulnerable handler during the affected period."
}