OpenSSL PQC Private Key Encryption Bypass Vulnerability

Executive Summary

This vulnerability affects openssl_encrypt versions before 1.4.9. It allows attackers to bypass authentication by crafting files with unencrypted embedded post-quantum cryptography (PQC) private keys. These files decrypt successfully with any password, producing attacker-chosen plaintext while falsely indicating integrity verification.

Useful 0 Not Useful 0

Detection Guidance

Check installed versions of openssl_encrypt with: pip show openssl-encrypt or pip list | grep openssl-encrypt. Files with unencrypted embedded PQC keys may have metadata flags like pqc_key_encrypted:false or aead_binding:false. Inspect file metadata using hex editors or custom scripts to verify encryption status of embedded keys.

Useful 0 Not Useful 0

Impact Analysis

Attackers could gain unauthorized access to encrypted files, bypass password protection, and manipulate decrypted content. This could lead to data breaches, unauthorized modifications, or false integrity verification, making users believe files are secure when they are not.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could violate compliance requirements for data protection and integrity, such as GDPR's encryption standards or HIPAA's safeguards for protected health information. Failure to protect encrypted data adequately may result in regulatory penalties or legal consequences.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade openssl_encrypt to version 1.4.9 or later immediately. Avoid using legacy files with allow_unencrypted_pqc_key=True. Review and re-encrypt any files containing embedded PQC keys. Monitor for unauthorized decryption attempts or integrity verification failures.

Useful 0 Not Useful 0