CVE-2026-81702

9.8 Critique

Publiée le 27/08/2026 à 19:21 · Modifiée le 03/09/2026 à 17:09 · Analysée par le NVD · Source : disclosure@vulncheck.com

Description

openssl_encrypt before 1.4.9 fails to re-derive and validate fingerprints when loading identities from identity.json, allowing attackers to substitute public keys in identity stores. Attackers can replace legitimate public keys with their own while maintaining the claimed fingerprint, enabling silent key substitution where encryption uses attacker keys and signature verification appears valid.

Traduire en français

Produits concernés

Scores CVSS

Version	Score	Source	Vecteur
4.0	9.3 Critique	disclosure@vulncheck.com	`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X`
3.1	9.8 Critique	disclosure@vulncheck.com	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`

Faiblesses (CWE)

CWE-345

Références

https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-q8p3-7h6h-ghfr Vendor Advisory
https://www.vulncheck.com/advisories/openssl-encrypt-before-1.4.9-key-substitution-via-identity-load Third Party Advisory

CVE-2026-81702

Description

Produits concernés

Scores CVSS

Faiblesses (CWE)

Références

Ailleurs