PT-2026-32136 · Pypi · Openssl-Encrypt

Publicado 2026-04-01 · Atualizado 2026-04-01

OSV

CVSS v4.0

6.6

Média

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U

Summary

The revoke key method in openssl encrypt server/modules/keyserver/service.py at lines 195-270 accepts a client id parameter but never verifies that the requesting client is the same as key.owner client id.

Impact

Any authenticated client can revoke any other client's key, as long as they provide a valid revocation signature. While the signature requirement mitigates this somewhat (you need the private key to sign), the lack of ownership check is a defense-in-depth gap.

Recommended Fix

• Add an ownership check: verify client id == key.owner client id before allowing revocation
• Return 403 Forbidden if the requesting client does not own the key

Fix

Fixed in commit 05e45f3 on branch releases/1.4.x — added documentation that ML-DSA signature verification IS the cryptographic ownership check; added info-level logging on successful verification.

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

GHSA-HVC7-763R-4F3H

Produtos afetados

Openssl-Encrypt

Referências · 4

• https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-hvc7-763r-4f3h · Nota
• https://github.com/jahlives/openssl_encrypt · Nota
• https://github.com/jahlives/openssl_encrypt/commit/05e45f393886b5bf7e924d2dd42099a9dd37f91d · Nota
• https://osv.dev/vulnerability/GHSA-hvc7-763r-4f3h · Aviso do Fabricante