Executive brief
openssl_encrypt is a cryptography service library that includes an optional D-Bus daemon for managing encryption operations. A local attacker can bypass authorization checks on the D-Bus service and modify critical configuration parameters without permission, causing the service to reject all encryption requests or become unstable. This results in a persistent denial of service affecting any applications relying on the crypto service.
Technical details
The D-Bus Properties.Set method in openssl_encrypt 1.4.x lacks both polkit authorization checks (CWE-862) and input validation (CWE-20). An unauthenticated local user on the system bus can invoke Set to modify MaxConcurrentOperations (setting it to 0, negative values, or excessive values) or unbounded DefaultTimeout parameters. Setting MaxConcurrentOperations to 0 or negative values causes the concurrency gate to permanently refuse all operations; setting it to very large values removes rate limiting. The vulnerability affects only the 1.4.x line; the D-Bus service was removed in 1.5.x. The fix in version 1.4.9 adds polkit authorization under the dedicated ch.rmrf.openssl_encrypt.configure action and validates parameters against safe bounds, rejecting invalid values.
Affected products
- jahlives openssl_encrypt 1.4.x before 1.4.9
Timeline
- 2026-08-27: disclosed
- 2026-08-12: patched: Version 1.4.9 released with fix