https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 02:29:40 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-380465 EUVD-2026-380465 https://cve.radiocsirt.org/vuln/euvd-2026-380465 https://cve.radiocsirt.org/vuln/fkie_cve-2026-81683 <p>openssl_encrypt (pip package openssl-encrypt) versions 1.4.8 and earlier store an mTLS client private key in cleartext within a world-readable (0644) SharedPreferences file via the desktop GUI&#39;s Settings screen &#39;combined certificate and private key&#39; PEM field. A local attacker with file system access can read the exposed private key. Version 1.4.9 writes the PEM to a dedicated 0600 file, keeps only its path in SharedPreferences, and migrates/scrubs existing cleartext values.</p> <p>openssl_encrypt (pip package openssl-encrypt) versions 1.4.8 and earlier store an mTLS client private key in cleartext within a world-readable (0644) SharedPreferences file via the desktop GUI&#39;s Settings screen &#39;combined certificate and private key&#39; PEM field. A local attacker with file system access can read the exposed private key. Version 1.4.9 writes the PEM to a dedicated 0600 file, keeps only its path in SharedPreferences, and migrates/scrubs existing cleartext values.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-81683 https://cve.radiocsirt.org/vuln/ghsa-p8vp-h9v2-m833 <p>openssl_encrypt (pip package openssl-encrypt) versions 1.4.8 and earlier store an mTLS client private key in cleartext within a world-readable (0644) SharedPreferences file via the desktop GUI&#39;s Settings screen &#39;combined certificate and private key&#39; PEM field. A local attacker with file system access can read the exposed private key. Version 1.4.9 writes the PEM to a dedicated 0600 file, keeps only its path in SharedPreferences, and migrates/scrubs existing cleartext values.</p> <p>openssl_encrypt (pip package openssl-encrypt) versions 1.4.8 and earlier store an mTLS client private key in cleartext within a world-readable (0644) SharedPreferences file via the desktop GUI&#39;s Settings screen &#39;combined certificate and private key&#39; PEM field. A local attacker with file system access can read the exposed private key. Version 1.4.9 writes the PEM to a dedicated 0600 file, keeps only its path in SharedPreferences, and migrates/scrubs existing cleartext values.</p> https://cve.radiocsirt.org/vuln/ghsa-p8vp-h9v2-m833 https://cve.radiocsirt.org/vuln/pysec-2026-3792 <p><strong>Affected:</strong> PyPI: openssl-encrypt</p> <p>openssl_encrypt (pip package openssl-encrypt) versions 1.4.8 and earlier store an mTLS client private key in cleartext within a world-readable (0644) SharedPreferences file via the desktop GUI&#39;s Settings screen &#39;combined certificate and private key&#39; PEM field. A local attacker with file system access can read the exposed private key. Version 1.4.9 writes the PEM to a dedicated 0600 file, keeps only its path in SharedPreferences, and migrates/scrubs existing cleartext values.</p> <p><strong>Affected:</strong> PyPI: openssl-encrypt</p> <p>openssl_encrypt (pip package openssl-encrypt) versions 1.4.8 and earlier store an mTLS client private key in cleartext within a world-readable (0644) SharedPreferences file via the desktop GUI&#39;s Settings screen &#39;combined certificate and private key&#39; PEM field. A local attacker with file system access can read the exposed private key. Version 1.4.9 writes the PEM to a dedicated 0600 file, keeps only its path in SharedPreferences, and migrates/scrubs existing cleartext values.</p> https://cve.radiocsirt.org/vuln/pysec-2026-3792