Uncontrolled Search Path Element Affecting openssl-encrypt package, versions [,1.4.0)

openssl-encrypt is an A package for secure file encryption and decryption based on modern ciphers using heavy-compute-load chaining of hashing and KDF to generate strong encryption password based on users provided password to ensure secure encryption of files

Affected versions of this package are vulnerable to Uncontrolled Search Path Element through the dynamic loading in hash_registry.py when a broad glob pattern is used to locate .so files without verifying their integrity. An attacker can execute arbitrary native code by placing a malicious .so file matching the expected pattern in a site-packages directory.

• GitHub Advisory
• GitHub Commit