Description

openssl_encrypt (pip package openssl-encrypt) before 1.4.9 contains two weaknesses in the portable USB drive feature, whose threat model treats the removable drive as untrusted (attacker with physical write access). USBDriveCreator._verify_integrity_file only validates files listed in the manifest, so files added to the drive — including a root-level autorun payload — are not detected and integrity verification still passes. Additionally, a globally constant, source-embedded KDF salt (_LEGACY_FIXED_SALT) is used to derive the drive encryption key for any drive lacking a per-drive salt file, defeating precomputation resistance and enabling an offline rainbow-table attack.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.5",
  "pubDate": "2026-08-27T17:21:02.033Z",
  "pubdate": "2026-08-27T17:21:02.033Z",
  "executiveSummary": "The openssl-encrypt Python package (versions prior to 1.4.9) exhibits critical security flaws within its portable USB drive encryption implementation. These vulnerabilities include an insufficient integrity verification mechanism and the use of a hardcoded, static Key Derivation Function (KDF) salt.\nThe vulnerability allows an attacker with physical write access to a USB drive to bypass integrity checks by introducing arbitrary files, including malicious autorun payloads, which the system fails to validate against its internal manifest. Furthermore, the reliance on a source-embedded constant salt (_LEGACY_FIXED_SALT) significantly degrades the security of the encryption key derivation process.\nThe impact is severe, as it facilitates unauthorized payload execution and enables offline rainbow-table attacks against the encrypted drive's key. This renders the 'untrusted' threat model of the portable drive feature ineffective, as an attacker can manipulate drive contents without triggering alerts and potentially recover encryption keys through precomputed attacks.\nThese issues necessitate immediate patching to version 1.4.9 or later and a review of cryptographic key management practices to eliminate the use of predictable, static values in security-sensitive operations.",
  "technicalDetails": "The vulnerability resides in the USBDriveCreator component of the openssl-encrypt library, specifically impacting versions prior to 1.4.9. The library's design fails to enforce strict integrity validation for the entire contents of the managed USB medium.\nThe first vulnerability concerns the logic within USBDriveCreator._verify_integrity_file. The verification function performs a whitelist-based validation, checking only the files explicitly defined in a manifest file. This implementation is flawed because it does not account for untracked files present in the file system. Consequently, an attacker possessing physical access to the device can inject unauthorized files, such as autorun binaries or scripts, into the root directory of the USB drive. Because these files are not present in the manifest, the integrity check ignores them, allowing the malicious content to persist and potentially execute upon user interaction on a target host.\nThe second vulnerability involves the implementation of the Key Derivation Function (KDF) for drive encryption. When a drive lacks a specific, per-drive salt file, the library falls back to a globally constant, hardcoded salt defined as _LEGACY_FIXED_SALT. This practice is inherently insecure as it negates the primary purpose of a salt—to provide precomputation resistance. By using a static, well-known salt, the library allows an attacker who has obtained the encrypted drive or its metadata to execute offline rainbow-table attacks. An attacker can precompute hashes based on the constant salt to quickly derive the encryption key, thereby compromising the confidentiality of the stored data without needing to perform a full-scale brute-force search.\nThe attack flow for the integrity bypass involves an attacker physically modifying the USB drive, adding an untracked payload, and relying on the USBDriveCreator to perform a perfunctory integrity check that validates the manifest while ignoring the unauthorized additions. For the cryptographic compromise, the attacker performs offline cryptanalysis by leveraging the predictability of _LEGACY_FIXED_SALT to speed up key recovery. These flaws collectively allow for both system compromise via malicious payloads and data exfiltration via weakened cryptographic protections."
}