GHSA-J48Q-4C78-RHF9
Vulnerability from github – Published: 2026-03-31 23:31 – Updated: 2026-03-31 23:31
VLAI
Summary
openssl-encrypt: Dynamic .so loading for Whirlpool uses broad glob pattern without integrity verification
Details
Severity: HIGH
Summary
The Whirlpool hash implementation in openssl_encrypt/modules/registry/hash_registry.py at lines 570-589 uses glob patterns to find .so modules in site-packages and loads the first match via importlib without verifying module integrity.
Affected Code
for site_pkg in site.getsitepackages():
pattern = os.path.join(site_pkg, "whirlpool*py313*.so")
py313_modules = glob.glob(pattern)
if py313_modules:
module_path = py313_modules[0] # Takes first match
loader = ExtensionFileLoader("whirlpool", module_path)
spec = importlib.util.spec_from_file_location("whirlpool", module_path, loader=loader)
whirlpool_module = importlib.util.module_from_spec(spec)
spec.loader.exec_module(whirlpool_module)
Impact
The glob pattern "whirlpool*py313*.so" is broad and takes the first match without verifying:
- File hash/signature
- File ownership/permissions
- Whether it's a legitimate module
If an attacker can place a malicious .so file matching this pattern in any site-packages directory, it will be loaded and native code executed.
Recommended Fix
- Verify the module's integrity (hash or signature) before loading
- Use a specific filename rather than a glob pattern
- Check file permissions and ownership
Fix
Fixed in commit 963d0d1 on branch releases/1.4.x — added os.path.realpath() to resolve symlinks and validation that found .so files are within known site-packages directories before loading.
Severity
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "openssl-encrypt"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.4.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-427"
],
"github_reviewed": true,
"github_reviewed_at": "2026-03-31T23:31:29Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "## Severity: HIGH\n\n### Summary\n\nThe Whirlpool hash implementation in `openssl_encrypt/modules/registry/hash_registry.py` at **lines 570-589** uses glob patterns to find `.so` modules in site-packages and loads the first match via `importlib` without verifying module integrity.\n\n### Affected Code\n\n```python\nfor site_pkg in site.getsitepackages():\n pattern = os.path.join(site_pkg, \"whirlpool*py313*.so\")\n py313_modules = glob.glob(pattern)\n if py313_modules:\n module_path = py313_modules[0] # Takes first match\n loader = ExtensionFileLoader(\"whirlpool\", module_path)\n spec = importlib.util.spec_from_file_location(\"whirlpool\", module_path, loader=loader)\n whirlpool_module = importlib.util.module_from_spec(spec)\n spec.loader.exec_module(whirlpool_module)\n```\n\n### Impact\n\nThe glob pattern `\"whirlpool*py313*.so\"` is broad and takes the first match without verifying:\n- File hash/signature\n- File ownership/permissions\n- Whether it\u0027s a legitimate module\n\nIf an attacker can place a malicious `.so` file matching this pattern in any site-packages directory, it will be loaded and native code executed.\n\n### Recommended Fix\n\n- Verify the module\u0027s integrity (hash or signature) before loading\n- Use a specific filename rather than a glob pattern\n- Check file permissions and ownership\n\n### Fix\n\nFixed in commit `963d0d1` on branch `releases/1.4.x` \u2014 added os.path.realpath() to resolve symlinks and validation that found .so files are within known site-packages directories before loading.",
"id": "GHSA-j48q-4c78-rhf9",
"modified": "2026-03-31T23:31:29Z",
"published": "2026-03-31T23:31:29Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-j48q-4c78-rhf9"
},
{
"type": "WEB",
"url": "https://github.com/jahlives/openssl_encrypt/commit/963d0d1278b722ea134272f9df65fddcd3e6ab47"
},
{
"type": "PACKAGE",
"url": "https://github.com/jahlives/openssl_encrypt"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U",
"type": "CVSS_V4"
}
],
"summary": "openssl-encrypt: Dynamic .so loading for Whirlpool uses broad glob pattern without integrity verification"
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…