https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 17:21:55 +0000 https://cve.radiocsirt.org/vuln/cve-2026-74876 <p><strong>Affected:</strong> jahlives openssl_encrypt</p> <p>openssl_encrypt versions before 1.4.0 contain a vulnerability in PublicKeyBundle.from_dict() that creates key bundles from untrusted data without verifying signatures. Attackers can call from_dict() followed by to_identity() without signature verification to encrypt data using attacker-controlled public keys, leaking secrets.</p> <p><strong>Affected:</strong> jahlives openssl_encrypt</p> <p>openssl_encrypt versions before 1.4.0 contain a vulnerability in PublicKeyBundle.from_dict() that creates key bundles from untrusted data without verifying signatures. Attackers can call from_dict() followed by to_identity() without signature verification to encrypt data using attacker-controlled public keys, leaking secrets.</p> https://cve.radiocsirt.org/vuln/cve-2026-74876 https://cve.radiocsirt.org/vuln/ghsa-8h88-gxp3-j7pg <p><strong>Affected:</strong> PyPI: openssl-encrypt</p> <p>### Summary</p> <p>The `PublicKeyBundle.from_dict()` method in `openssl_encrypt/modules/key_bundle.py` at **lines 329-361** creates bundles from untrusted data without verifying the signature. The docstring warns to call `verify_signature()` after creation, but the `to_identity()` method (line 363-391) can convert an unverified bundle directly to an `Identity` object.</p> <p>### Affected Code</p> <p>```python @classmethod def from_dict(cls, data: Dict) -&gt; &#34;PublicKeyBundle&#34;: &#34;&#34;&#34; SECURITY: Does NOT verify signature. Call verify_signature() after creation. &#34;&#34;&#34; # Creates bundle without verification ```</p> <p>### Impact</p> <p>If `from_dict()` followed by `to_identity()` is called without an intervening `verify_signature()` call, encryption could be performed against an attacker&#39;s public key, leaking secrets. While `key_resolver.py` (lines 146-147) does verify before use, the unguarded API path remains directly callable.</p> <p>### Recommended Fix</p> <p>- Add a `verified` flag to `PublicKeyBundle` that must be set before `to_identity()` can be called - Or have `to_identity()` automatically call `verify_signature()` and raise on failure - Or make `from_dict()` require verification as part of construction</p> <p>### Fix</p> <p>Fixed in commit `f4a1ba6` on branch `releases/1.4.x` — from_dict() now verifies self_signature by default (verify=True parameter); raises ValueError on verification failure.</p> <p><strong>Affected:</strong> PyPI: openssl-encrypt</p> <p>### Summary</p> <p>The `PublicKeyBundle.from_dict()` method in `openssl_encrypt/modules/key_bundle.py` at **lines 329-361** creates bundles from untrusted data without verifying the signature. The docstring warns to call `verify_signature()` after creation, but the `to_identity()` method (line 363-391) can convert an unverified bundle directly to an `Identity` object.</p> <p>### Affected Code</p> <p>```python @classmethod def from_dict(cls, data: Dict) -&gt; &#34;PublicKeyBundle&#34;: &#34;&#34;&#34; SECURITY: Does NOT verify signature. Call verify_signature() after creation. &#34;&#34;&#34; # Creates bundle without verification ```</p> <p>### Impact</p> <p>If `from_dict()` followed by `to_identity()` is called without an intervening `verify_signature()` call, encryption could be performed against an attacker&#39;s public key, leaking secrets. While `key_resolver.py` (lines 146-147) does verify before use, the unguarded API path remains directly callable.</p> <p>### Recommended Fix</p> <p>- Add a `verified` flag to `PublicKeyBundle` that must be set before `to_identity()` can be called - Or have `to_identity()` automatically call `verify_signature()` and raise on failure - Or make `from_dict()` require verification as part of construction</p> <p>### Fix</p> <p>Fixed in commit `f4a1ba6` on branch `releases/1.4.x` — from_dict() now verifies self_signature by default (verify=True parameter); raises ValueError on verification failure.</p> https://cve.radiocsirt.org/vuln/ghsa-8h88-gxp3-j7pg