Executive brief
openssl_encrypt is a Python library for encrypting sensitive data using password-protected keys. Versions before 1.4.9 derive encryption keys using an unsalted, non-memory-hard algorithm, allowing attackers with access to encrypted pepper blobs to perform offline password guessing attacks at hardware speed. A compromised or malicious keyserver can precompute a single dictionary table to recover user passwords across all accounts simultaneously.
Technical details
The vulnerability is a weak cryptographic key derivation (CWE-916) in the remote-pepper feature. Affected versions derive the AES-GCM wrap key using either unsalted HKDF-SHA256 or bare SHA-256 of the user's password, with no per-blob salt or additional authenticated data (AAD). This allows identical wrap keys for the same password across all users and files. An attacker with read access to wrapped pepper blobs (stored on a keyserver) can precompute a single dictionary table and perform fleet-wide offline password guessing; the non-memory-hard derivation runs at hardware speed (~2 SHA-256 operations per guess). Fix 1.4.9 introduces v2 wrapped-pepper blobs using Argon2id key derivation with per-blob random salt and includes pepper name as AAD, making offline guessing infeasible. Legacy blobs remain readable for backward compatibility.
Affected products
- jahlives openssl_encrypt before 1.4.9
Timeline
- 2026-08-12: disclosed
- 2026-08-27: advisory
- 2026-08-27: patched: Version 1.4.9 available