Executive brief
openssl_encrypt is a command-line encryption utility that displays file metadata through its info command. A flaw allows attackers to craft malicious encrypted files with terminal control characters embedded in metadata fields, which are then printed without sanitization, letting attackers repaint terminal output and forge verification information that users rely on to validate file integrity.
Technical details
The vulnerability is an improper output neutralization flaw (CWE-117) in the print_file_info function of openssl_encrypt versions before 1.4.9. The info command prints metadata fields (algorithm, encryption_data, cipher_chain, layer_info, hashes, keys, and plugin configurations) directly to the terminal without escaping terminal control characters such as ANSI escape sequences and bidirectional text overrides. Because the v14 schema allows additionalProperties in the encryption object and the JSON validator does not sanitize escape sequences during parsing, a crafted file with embedded \u001b or other control characters can survive decoding and be emitted raw to the terminal. An attacker can leverage cursor-movement, erase-line, and bidirectional override bytes to repaint output, including forging the Fingerprint/verification line that users consult. The fix in version 1.4.9 applies sanitize_for_display() to all metadata-derived values and the reconstructed CLI printer line before terminal output.
Affected products
- jahlives openssl_encrypt before 1.4.9
Timeline
- 2026-08-12: disclosed
- 2026-08-12: patched: Version 1.4.9 released with sanitize_for_display() fix