Authentication Bypass in OpenSSL CamelliaCipher via PYTEST_CURRENT_TEST

Executive Summary

This vulnerability affects the openssl_encrypt Python package versions below 1.4.0. It involves an authentication bypass in the Camellia cipher implementation where setting the PYTEST_CURRENT_TEST environment variable disables HMAC tag generation and verification. This allows unauthenticated ciphertext to be produced and processed, bypassing integrity protections.

Useful 0 Not Useful 0

Detection Guidance

Check if the openssl_encrypt package version is below 1.4.0 by running pip show openssl_encrypt or pip list. Inspect environment variables for PYTEST_CURRENT_TEST set in processes using ps aux | grep PYTEST_CURRENT_TEST or env | grep PYTEST_CURRENT_TEST.

Useful 0 Not Useful 0

Impact Analysis

Attackers with code execution can exploit this to generate ciphertext without HMAC tags or skip HMAC verification during decryption. This undermines data integrity, allowing tampering with encrypted data without detection. Systems relying on this package for encryption may expose sensitive data to unauthorized modification.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability compromises data integrity protections, which are critical for compliance with GDPR and HIPAA. GDPR requires integrity and confidentiality of personal data, while HIPAA mandates safeguards for protected health information. Exploiting this flaw could lead to unauthorized data tampering, violating these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade openssl_encrypt to version 1.4.0 or later immediately. Remove or unset the PYTEST_CURRENT_TEST environment variable in all environments. Review and audit code for any use of CamelliaCipher in encryption operations.

Useful 0 Not Useful 0