PT-2026-32070 · Pypi · Openssl-Encrypt

Published

2026-03-31

·

Updated

2026-03-31

CVSS v4.0

6.6

Medium

VectorAV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U

Summary

Passwords passed via the --password / -p CLI argument in openssl encrypt/modules/crypt cli subparser.py at lines 150-154 are visible to any user on the system via ps aux or /proc/[pid]/cmdline.

Affected Code

python
subparser.add argument(
  "--password", "-p",
  help="Password (will prompt if not provided, or use CRYPT PASSWORD environment variable)",
)
Similarly, --keystore-password exposes the keystore password.

Impact

On multi-user systems, any user can observe the encryption password by listing processes. The CRYPT PASSWORD environment variable alternative is also visible via /proc/[pid]/environ (though with slightly restricted access).

Recommended Fix

  • Document the security implications prominently
  • Recommend interactive prompting (already supported) as the secure default
  • Consider supporting password file descriptors (--password-fd) or reading from stdin
  • Consider marking the argument as deprecated in favor of interactive prompting

Fix

Fixed in commit e78a366 on branch releases/1.4.x — added --password-file and --password-fd arguments; added OPENSSL ENCRYPT PASSWORD env var support; --password now emits deprecation warning.

Fix

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-256

Related Identifiers

GHSA-H3M5-P59H-X88P

Affected Products

Openssl-Encrypt