Executive brief
openssl-encrypt is a Python library that provides encryption and steganography functionality through both a CLI and desktop GUI. A vulnerability in the GUI causes it to pass the steganography password as a visible command-line argument to child processes, allowing any local user on the system to read this sensitive credential from process listings. This exposes user encryption passwords to unauthorized access by other local users.
Technical details
The vulnerability is an information disclosure flaw (CWE-214) in the desktop GUI component of openssl-encrypt. The GUI incorrectly passes the steganography password as a command-line argument (--stego-password) to the CLI subprocess on both encrypt and decrypt paths, while the main password correctly uses the CRYPT_PASSWORD environment variable. Any local user without special privileges can read the steganography password from /proc/<pid>/cmdline for the duration of the subprocess execution. The fix in version 1.4.9 introduces a CRYPT_STEGO_PASSWORD environment variable channel that mirrors the CRYPT_PASSWORD convention, with the GUI passing the steganography password via the child process environment and the CLI reading it as a fallback, then clearing it to prevent exposure.
Affected products
- openssl-encrypt openssl-encrypt <=1.4.8
Timeline
- 2026-08-27: disclosed
- 2026-08-12: patched: Version 1.4.9 available