CVE-2026-74890

5.5 Moyenne

Publiée le 17/08/2026 à 13:16 · Modifiée le 01/09/2026 à 17:26 · Analysée par le NVD · Source : disclosure@vulncheck.com

Description

openssl_encrypt versions before 1.4.0 contain an authentication bypass vulnerability in CamelliaCipher that disables HMAC tag generation and verification when the PYTEST_CURRENT_TEST environment variable is set. Attackers with code execution can set this environment variable to produce unauthenticated ciphertext and bypass integrity protection on encrypted data.

Traduire en français

Produits concernés

Scores CVSS

Version	Score	Source	Vecteur
4.0	9.3 Critique	disclosure@vulncheck.com	`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X`
3.1	5.5 Moyenne	disclosure@vulncheck.com	`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N`

Faiblesses (CWE)

CWE-345

Références

https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-rvc2-5jxq-gpcj MitigationVendor Advisory
https://www.vulncheck.com/advisories/openssl-encrypt-before-hmac-authentication-bypass-via-environment-variable Third Party Advisory

CVE-2026-74890

Description

Produits concernés

Scores CVSS

Faiblesses (CWE)

Références

Ailleurs