https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 22:39:55 +0000 https://cve.radiocsirt.org/vuln/cve-2026-74872 <p><strong>Affected:</strong> jahlives openssl_encrypt</p> <p>openssl_encrypt versions before 1.4.0 contain an arbitrary code execution vulnerability in the Whirlpool hash implementation that uses broad glob patterns to load .so modules without integrity verification. Attackers can place malicious .so files matching the whirlpool*py313*.so pattern in site-packages directories to achieve native code execution when the module is loaded.</p> <p><strong>Affected:</strong> jahlives openssl_encrypt</p> <p>openssl_encrypt versions before 1.4.0 contain an arbitrary code execution vulnerability in the Whirlpool hash implementation that uses broad glob patterns to load .so modules without integrity verification. Attackers can place malicious .so files matching the whirlpool*py313*.so pattern in site-packages directories to achieve native code execution when the module is loaded.</p> https://cve.radiocsirt.org/vuln/cve-2026-74872 https://cve.radiocsirt.org/vuln/ghsa-j48q-4c78-rhf9 <p><strong>Affected:</strong> PyPI: openssl-encrypt</p> <p>## Severity: HIGH</p> <p>### Summary</p> <p>The Whirlpool hash implementation in `openssl_encrypt/modules/registry/hash_registry.py` at **lines 570-589** uses glob patterns to find `.so` modules in site-packages and loads the first match via `importlib` without verifying module integrity.</p> <p>### Affected Code</p> <p>```python for site_pkg in site.getsitepackages(): pattern = os.path.join(site_pkg, &#34;whirlpool*py313*.so&#34;) py313_modules = glob.glob(pattern) if py313_modules: module_path = py313_modules[0] # Takes first match loader = ExtensionFileLoader(&#34;whirlpool&#34;, module_path) spec = importlib.util.spec_from_file_location(&#34;whirlpool&#34;, module_path, loader=loader) whirlpool_module = importlib.util.module_from_spec(spec) spec.loader.exec_module(whirlpool_module) ```</p> <p>### Impact</p> <p>The glob pattern `&#34;whirlpool*py313*.so&#34;` is broad and takes the first match without verifying: - File hash/signature - File ownership/permissions - Whether it&#39;s a legitimate module</p> <p>If an attacker can place a malicious `.so` file matching this pattern in any site-packages directory, it will be loaded and native code executed.</p> <p>### Recommended Fix</p> <p>- Verify the module&#39;s integrity (hash or signature) before loading - Use a specific filename rather than a glob pattern - Check file permissions and ownership</p> <p>### Fix</p> <p>Fixed in commit `963d0d1` on branch `releases/1.4.x` — added os.path.realpath() to resolve symlinks and validation that found .so files are within known site-pac…</p> <p><strong>Affected:</strong> PyPI: openssl-encrypt</p> <p>## Severity: HIGH</p> <p>### Summary</p> <p>The Whirlpool hash implementation in `openssl_encrypt/modules/registry/hash_registry.py` at **lines 570-589** uses glob patterns to find `.so` modules in site-packages and loads the first match via `importlib` without verifying module integrity.</p> <p>### Affected Code</p> <p>```python for site_pkg in site.getsitepackages(): pattern = os.path.join(site_pkg, &#34;whirlpool*py313*.so&#34;) py313_modules = glob.glob(pattern) if py313_modules: module_path = py313_modules[0] # Takes first match loader = ExtensionFileLoader(&#34;whirlpool&#34;, module_path) spec = importlib.util.spec_from_file_location(&#34;whirlpool&#34;, module_path, loader=loader) whirlpool_module = importlib.util.module_from_spec(spec) spec.loader.exec_module(whirlpool_module) ```</p> <p>### Impact</p> <p>The glob pattern `&#34;whirlpool*py313*.so&#34;` is broad and takes the first match without verifying: - File hash/signature - File ownership/permissions - Whether it&#39;s a legitimate module</p> <p>If an attacker can place a malicious `.so` file matching this pattern in any site-packages directory, it will be loaded and native code executed.</p> <p>### Recommended Fix</p> <p>- Verify the module&#39;s integrity (hash or signature) before loading - Use a specific filename rather than a glob pattern - Check file permissions and ownership</p> <p>### Fix</p> <p>Fixed in commit `963d0d1` on branch `releases/1.4.x` — added os.path.realpath() to resolve symlinks and validation that found .so files are within known site-pac…</p> https://cve.radiocsirt.org/vuln/ghsa-j48q-4c78-rhf9