CVE-2026-81717 in openssl_encrypt
Summary
by MITRE • 08/27/2026
openssl_encrypt (pip package openssl-encrypt) before 1.4.9 contains two weaknesses in the portable USB drive feature, whose threat model treats the removable drive as untrusted (attacker with physical write access). USBDriveCreator._verify_integrity_file only validates files listed in the manifest, so files added to the drive — including a root-level autorun payload — are not detected and integrity verification still passes. Additionally, a globally constant, source-embedded KDF salt (_LEGACY_FIXED_SALT) is used to derive the drive encryption key for any drive lacking a per-drive salt file, defeating precomputation resistance and enabling an offline rainbow-table attack.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/27/2026
The openssl_encrypt Python package prior to version 1.4.9 contains critical security flaws within its portable USB drive feature that fundamentally undermine the integrity and confidentiality guarantees intended by the threat model. The design assumes a scenario where removable drives are untrusted, meaning an attacker with physical write access could attempt to tamper with data or inject malicious payloads. However, the implementation fails to adequately enforce these security boundaries due to two distinct weaknesses: one related to file integrity verification and another concerning cryptographic key derivation. These issues collectively allow for unauthorized code execution and offline decryption of sensitive data stored on compromised drives.
The first vulnerability resides in the USBDriveCreator._verify_integrity_file method, which is responsible for ensuring that files on the portable drive have not been altered or replaced by an attacker. The implementation flaw lies in its reliance solely on a manifest file to determine which files require integrity checks. This approach creates a blind spot because any new files added to the root directory of the USB drive are excluded from verification processes. Consequently, if an attacker with physical access inserts a malicious executable disguised as or named like an autorun script into the root level, this payload will not be validated against its expected hash. When the system loads, it may execute this unverified code without triggering any integrity warnings, effectively bypassing the security controls designed to prevent tampering. This behavior aligns with CWE-354, which describes improper validation of integrity check values, and represents a significant deviation from secure coding practices that require comprehensive file system auditing rather than selective verification based on static lists.
The second vulnerability involves the cryptographic key derivation mechanism used for encrypting data on the portable drive. The package utilizes a globally constant salt value, identified as _LEGACY_FIXED_SALT, embedded directly in the source code to derive encryption keys via a Key Derivation Function (KDF). This practice is applied specifically when a per-drive salt file is absent or cannot be located. By using a fixed, publicly known salt instead of generating unique, random salts for each drive instance, the system eliminates precomputation resistance. Attackers can perform offline rainbow-table attacks by precomputing hash chains for common passwords combined with this specific static salt. This drastically reduces the computational effort required to crack encryption keys compared to scenarios where unique salts are employed, thereby exposing user data to unauthorized decryption if password strength is insufficient or if brute-force techniques are applied over time.
The operational impact of these vulnerabilities is severe in environments relying on physical security measures for data protection. The integrity verification flaw enables arbitrary code execution through autorun mechanisms, potentially leading to full system compromise when the drive is connected to a victim machine that automatically executes files from removable media. This maps directly to MITRE ATT&CK technique T1204, specifically User Execution or Malicious Software Collection via Removable Media. Simultaneously, the weak key derivation allows adversaries who obtain physical access to the encrypted storage medium to decrypt sensitive information offline without needing network connectivity or interaction with the target system. This undermines confidentiality and violates principles outlined in CWE-328 regarding the use of weak cryptographic algorithms or poor random number generation practices that fail to provide adequate entropy for security-critical operations.
To mitigate these risks, immediate updates to version 1.4.9 or later are required, as they address both the integrity verification logic and the key derivation parameters. For systems unable to upgrade immediately, administrators should disable auto-run features on all endpoints connected to portable drives managed by this software to prevent execution of unverified payloads. Additionally, ensuring that per-drive salt files are generated and stored correctly can mitigate the rainbow-table risk until a full patch is applied. Security teams must also enforce strict policies regarding physical access to removable media and consider implementing additional endpoint detection controls to monitor for suspicious file creation in root directories of external storage devices. Regular audits of manifest integrity mechanisms should be conducted to ensure that future updates do not reintroduce selective verification gaps, maintaining alignment with industry standards for secure software development such as OWASP guidelines on input validation and cryptographic implementation.