Executive brief
openssl-encrypt is a Python library that creates encrypted portable USB workspaces. Versions 1.4.8 and earlier falsely advertise AES-256-GCM encryption protection while actually storing workspace files in cleartext, leaving sensitive data on removable media unprotected. An attacker with physical access to the USB device can read all files placed in the workspace, defeating the user's expectation of encryption.
Technical details
The vulnerability is a missing encryption flaw (CWE-311) where the openssl-encrypt library derives an encryption key but never applies it to the portable USB workspace directory. While the tool marks the workspace as encrypted and displays AES-256-GCM branding, files are stored unencrypted on the removable media. An attacker with physical access to the USB device can trivially extract all files from the workspace. The vulnerability requires physical access to the media but enables full disclosure of sensitive data. Version 1.4.9 fixes the issue by genuinely encrypting the workspace contents into an authenticated AES-256-GCM vault that must be unlocked with the master password.
Affected products
- openssl-encrypt openssl-encrypt <=1.4.8
Timeline
- 2026-08-12: disclosed
- 2026-08-27: patched: Version 1.4.9 released with genuine AES-256-GCM encryption for workspace contents