Описание
openssl_encrypt versions before 1.4.0 expose passwords passed via the --password CLI argument in process listings accessible to all system users. Attackers can read process arguments through ps aux or /proc/[pid]/cmdline to retrieve plaintext passwords and keystore passwords.
Ссылки
- MitigationVendor Advisory
- Third Party Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 1.4.0 (исключая)
cpe:2.3:a:jahlives:openssl_encrypt:*:*:*:*:*:python:*:*
EPSS
Процентиль: 13%
0.00227
Низкий
5.5 Medium
CVSS3
Дефекты
CWE-214
Связанные уязвимости
CVSS3: 5.5
github
около 1 месяца назад
openssl_encrypt versions before 1.4.0 expose passwords passed via the --password CLI argument in process listings accessible to all system users. Attackers can read process arguments through ps aux or /proc/[pid]/cmdline to retrieve plaintext passwords and keystore passwords.
EPSS
Процентиль: 13%
0.00227
Низкий
5.5 Medium
CVSS3
Дефекты
CWE-214