Description
openssl_encrypt versions before 1.4.0 expose passwords passed via the --password CLI argument in process listings accessible to all system users. Attackers can read process arguments through ps aux or /proc/[pid]/cmdline to retrieve plaintext passwords and keystore passwords.
Published: 2026-08-17
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability allows a system user to obtain plaintext passwords passed to the openssl_encrypt utility via the --password command‑line option because the password appears in the process command string. Once exposed, anyone able to view process listings can read the password and potentially compromise keystore security.

Affected Systems

The affected product is openssl_encrypt by jahlives. Any installation of version 1.3.x or earlier is vulnerable; upgrading to 1.4.0 or later removes the flaw.

Risk and Exploitability

The CVSS score is 8.7, indicating high severity. The EPSS score is not provided, and the vulnerability is not listed in the CISA KEV catalog. The attack can be performed locally by any user who has permission to view process metadata, typically through ps aux or reading /proc/[pid]/cmdline. No additional network exposure or privilege escalation is required beyond local access.

Generated by OpenCVE AI on August 17, 2026 at 12:34 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade openssl_encrypt to version 1.4.0 or later
  • Avoid supplying passwords on the command line; supply them through a secure input method instead
  • If an upgrade is not immediately possible, restrict system-wide process visibility by setting appropriate PAM or group access controls to limit who can view process arguments

Generated by OpenCVE AI on August 17, 2026 at 12:34 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 01 Sep 2026 22:00:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:jahlives:openssl_encrypt:*:*:*:*:*:python:*:*

Fri, 21 Aug 2026 13:00:00 +0000

Type Values Removed Values Added
First Time appeared Jahlives
Jahlives openssl Encrypt
Vendors & Products Jahlives
Jahlives openssl Encrypt

Mon, 17 Aug 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 17 Aug 2026 11:15:00 +0000

Type Values Removed Values Added
Description openssl_encrypt versions before 1.4.0 expose passwords passed via the --password CLI argument in process listings accessible to all system users. Attackers can read process arguments through ps aux or /proc/[pid]/cmdline to retrieve plaintext passwords and keystore passwords.
Title openssl_encrypt before 1.4.0 Password Exposure via CLI Argument
Weaknesses CWE-214
References
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Jahlives Openssl Encrypt
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-08-17T14:35:59.003Z

Reserved: 2026-08-17T10:31:04.593Z

Link: CVE-2026-74873

cve-icon Vulnrichment

Updated: 2026-08-17T14:35:51.762Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-17T11:16:41.690

Modified: 2026-09-01T15:29:11.337

Link: CVE-2026-74873

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-21T12:41:08Z

Weaknesses
  • CWE-214

    Invocation of Process Using Visible Sensitive Information