Executive brief
openssl-encrypt is a Python package that provides USB verification for portable tool installations. The verify-usb component failed to properly detect symlinks on removable drives, allowing an attacker with physical access to replace a legitimate directory with a symlink containing malicious code. When a victim runs the portable install after verification passes, the attacker's code executes instead of the legitimate tools.
Technical details
The vulnerability is a symlink-following flaw (CWE-59) in the verify-usb v2 allowlist scan. The scan uses rglob() to enumerate files, which does not descend into symlinked directories, while the hash verification uses O_NOFOLLOW that only binds the final path component. An evil-maid attacker with physical access can replace a tool-tree directory with a symlink pointing to a copy containing byte-identical files plus a planted __pycache__/*.pyc file (which Python loads preferentially). The planted file remains unenumerated, added_files counter stays 0, and verify-usb incorrectly reports PASSED. The fix in 1.4.9 replaces rglob() with os.walk(followlinks=False) and flags any symlinked path component as tampering, causing legitimate installs without symlinks to pass and malicious symlink-based attacks to fail.
Affected products
- jahlives openssl-encrypt before 1.4.9 (affects 1.4.x and 1.5.x lines)
Timeline
- 2026-08-27: disclosed
- 2026-08-12: patched: Version 1.4.9 released with fix