GHSA-h3m5-p59h-x88p

Source

https://github.com/advisories/GHSA-h3m5-p59h-x88p

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-h3m5-p59h-x88p/GHSA-h3m5-p59h-x88p.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-h3m5-p59h-x88p

Aliases

Published

2026-03-31T23:42:17Z

Modified

2026-09-02T09:10:38Z

Severity

6.6 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U CVSS Calculator

Summary

openssl-encrypt has visible password in process list via --password CLI argument

Details

Summary

Passwords passed via the --password / -p CLI argument in openssl_encrypt/modules/crypt_cli_subparser.py at lines 150-154 are visible to any user on the system via ps aux or /proc/[pid]/cmdline.

Affected Code

subparser.add_argument(
    "--password", "-p",
    help="Password (will prompt if not provided, or use CRYPT_PASSWORD environment variable)",
)

Similarly, --keystore-password exposes the keystore password.

Impact

On multi-user systems, any user can observe the encryption password by listing processes. The CRYPT_PASSWORD environment variable alternative is also visible via /proc/[pid]/environ (though with slightly restricted access).

Recommended Fix

Document the security implications prominently
Recommend interactive prompting (already supported) as the secure default
Consider supporting password file descriptors (--password-fd) or reading from stdin
Consider marking the argument as deprecated in favor of interactive prompting

Fix

Fixed in commit e78a366 on branch releases/1.4.x — added --password-file and --password-fd arguments; added OPENSSL_ENCRYPT_PASSWORD env var support; --password now emits deprecation warning.

Database specific

{
    "cwe_ids":  [
        "CWE-256"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-03-31T23:42:17Z",
    "nvd_published_at":  null,
    "severity":  "MODERATE"
}

References

Affected packages

PyPI / openssl-encrypt

Package

Name: openssl-encrypt; View open source insights on deps.dev
Purl: pkg:pypi/openssl-encrypt

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.4.0

Affected versions

0.*

0.2.2

0.2.3

0.2.4

0.2.5

0.2.6

0.3.0

0.3.1

0.3.2

0.3.3

0.4.0

0.4.1

0.4.2

0.4.3

0.4.4

0.5.0

0.5.1

0.5.3

0.6.0rc1

0.7.0rc2

0.7.1

0.7.2

0.8.0

0.8.1

0.8.2

0.9.2

1.*

1.0.0

1.0.1

1.0.2

1.0.3

1.1.0

1.2.0

1.2.1

1.3.0

1.3.1

1.3.2

1.3.3

1.3.4

1.3.5

1.4.0b3

1.4.0b4

1.4.0b5

1.4.0b6

1.4.0b7

1.4.0b8

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-h3m5-p59h-x88p/GHSA-h3m5-p59h-x88p.json"