Description

openssl_encrypt before 1.4.9 fails to prevent namespace collisions between own identities and contacts in IdentityStore, allowing attackers to create shadowed contact entries invisible until the corresponding own identity is deleted. When the own identity is deleted, the shadowed contact becomes visible and resolves to the attacker's keys, enabling silent key substitution for encrypted files.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.8",
  "pubDate": "2026-08-27T17:21:01.293Z",
  "pubdate": "2026-08-27T17:21:01.293Z",
  "executiveSummary": "The vulnerability within openssl_encrypt versions prior to 1.4.9 involves a critical flaw in namespace management within the IdentityStore component. Specifically, the system fails to enforce sufficient separation between 'own identities' and 'contacts', allowing for namespace collisions. This architectural oversight permits an attacker to perform identity shadowing by injecting contact entries that mirror existing own identities.\nThe primary risk implication is the potential for silent cryptographic key substitution. By creating these shadowed entries, an attacker can manipulate the trust relationship established by the application. Once the legitimate 'own identity' is removed from the IdentityStore, the previously obscured malicious contact entry becomes active and assumes the identity of the deleted entry. Consequently, encrypted files or communications intended for the original identity are transparently resolved to the attacker's cryptographic keys. This enables unauthorized interception, decryption, or manipulation of encrypted data. The attack does not require complex infrastructure, relying primarily on the ability to manipulate the IdentityStore entries. Users remain unaware of the substitution because the impact only manifests after the deletion of an own identity, effectively bypassing standard identity verification controls during routine administrative operations.",
  "technicalDetails": "The root cause of this vulnerability lies in the insufficient logical isolation of identity objects within the IdentityStore of openssl_encrypt versions prior to 1.4.9. The implementation lacks a strict schema or prefixing mechanism to distinguish between identities owned by the local user ('own identities') and entries corresponding to external contacts. This lack of namespace segregation allows for overlapping identifiers or keys within the underlying data structure.\nThe exploitation flow proceeds as follows: First, an attacker identifies the naming convention or specific identifier associated with a victim's 'own identity'. Second, the attacker crafts a malicious contact entry within the IdentityStore that duplicates the identifier used by the target's 'own identity'. Because the system fails to perform collision detection or normalization checks during the insertion of contact objects, the system accepts the malicious entry despite the presence of the legitimate identity. During this phase, the shadowed entry is effectively dormant; the application logic prioritizes the legitimate 'own identity' due to internal ordering or lookup precedence.\nThe exploit reaches fruition when the victim performs a legitimate administrative action: the deletion of their own identity from the store. Upon the removal of the authorized record, the application's search and resolution logic defaults to the next available entry sharing the same identifier—the attacker's shadowed contact record. Because the system now resolves the compromised identity to the attacker's public/private key pairs, any subsequent cryptographic operations (such as file encryption or message signing) that rely on this identity store lookup will inadvertently use the attacker's keys.\nThis creates a silent key substitution condition. The attacker, possessing the corresponding private keys for the injected contact, can decrypt files encrypted for the victim's identity or forge digital signatures that the system incorrectly trusts as valid. The attack requires the ability to interact with the IdentityStore, but does not necessitate high-level privileges if the store is accessible via standard application interfaces. This vulnerability persists across any environment utilizing openssl_encrypt versions < 1.4.9 where identity resolution relies on shared naming namespaces without rigorous collision prevention logic."
}