{"id":"CVE-2026-74872","aliases":["EUVD-2026-60091","GHSA-ccp9-5g7c-pj86","GHSA-j48q-4c78-rhf9","PYSEC-2026-3742"],"status":"published","title":"openssl_encrypt before 1.4.0 Arbitrary Code Execution via Whirlpool","description":"openssl_encrypt versions before 1.4.0 contain an arbitrary code execution vulnerability in the Whirlpool hash implementation that uses broad glob patterns to load .so modules without integrity verification. Attackers can place malicious .so files matching the whirlpool*py313*.so pattern in site-packages directories to achieve native code execution when the module is loaded.","severity":{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00679,"percentile":0.52789,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-426","CWE-427"],"published":"2026-03-31T23:31:29Z","modified":"2026-10-28T02:31:06Z","fixes":[{"ecosystem":"PyPI","package":"openssl-encrypt","fixed_in":["1.4.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"openssl-encrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.0"}]}]},{"source":"osv","ecosystem":"PyPI","package":"openssl-encrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.0"}]}],"versions":["0.2.2","0.2.3","0.2.4","0.2.5","0.2.6","0.3.0","0.3.1","0.3.2","0.3.3","0.4.0","0.4.1","0.4.2","0.4.3","0.4.4","0.5.0","0.5.1","0.5.3","0.6.0rc1","0.7.0rc2","0.7.1","0.7.2","0.8.0","0.8.1","0.8.2","0.9.2","1.0.0","1.0.1","1.0.2","1.0.3","1.1.0","1.2.0","1.2.1","1.3.0","1.3.1","1.3.2","1.3.3","1.3.4","1.3.5","1.4.0b3","1.4.0b4","1.4.0b5","1.4.0b6","1.4.0b7","1.4.0b8"]},{"source":"osv","ecosystem":"PyPI","package":"openssl-encrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.0"}]}],"versions":["0.2.2","0.2.3","0.2.4","0.2.5","0.2.6","0.3.0","0.3.1","0.3.2","0.3.3","0.4.0","0.4.1","0.4.2","0.4.3","0.4.4","0.5.0","0.5.1","0.5.3","0.6.0rc1","0.7.0rc2","0.7.1","0.7.2","0.8.0","0.8.1","0.8.2","0.9.2","1.0.0","1.0.1","1.0.2","1.0.3","1.1.0","1.2.0","1.2.1","1.3.0","1.3.1","1.3.2","1.3.3","1.3.4","1.3.5","1.4.0b3","1.4.0b4","1.4.0b5","1.4.0b6","1.4.0b7","1.4.0b8"]}],"products":[{"vendor":"jahlives","product":"openssl_encrypt"}],"references":[{"url":"https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-j48q-4c78-rhf9","tags":["vendor-advisory","Mitigation","Vendor Advisory","advisory","web"]},{"url":"https://www.vulncheck.com/advisories/openssl-encrypt-before-arbitrary-code-execution-via-whirlpool","tags":["third-party-advisory","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74872","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-ccp9-5g7c-pj86"},{"url":"https://github.com/jahlives/openssl_encrypt/commit/963d0d1278b722ea134272f9df65fddcd3e6ab47","tags":["web"]},{"url":"https://github.com/advisories/GHSA-j48q-4c78-rhf9"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/74xxx/CVE-2026-74872.json","tags":["advisory"]},{"url":"https://github.com/jahlives/openssl_encrypt","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-74872","title":"openssl_encrypt before 1.4.0 Arbitrary Code Execution via Whirlpool","description":"openssl_encrypt versions before 1.4.0 contain an arbitrary code execution vulnerability in the Whirlpool hash implementation that uses broad glob patterns to load .so modules without integrity verification. Attackers can place malicious .so files matching the whirlpool*py313*.so pattern in site-packages directories to achieve native code execution when the module is loaded.","status":"published","published":"2026-08-17T11:04:41.525Z","modified":"2026-10-08T15:24:47.699Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical","assessor":"cna"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-426"],"updated_at":"2026-11-02T14:20:03.4818Z"}],"euvd":[{"id":"EUVD-2026-60091","description":"openssl_encrypt versions before 1.4.0 contain an arbitrary code execution vulnerability in the Whirlpool hash implementation that uses broad glob patterns to load .so modules without integrity verification. Attackers can place malicious .so files matching the whirlpool*py313*.so pattern in site-packages directories to achieve native code execution when the module is loaded.","status":"published","published":"2026-08-17T11:04:41Z","modified":"2026-10-08T15:24:47Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"}],"updated_at":"2026-11-02T17:27:31.218078Z"}],"ghsa":[{"id":"GHSA-ccp9-5g7c-pj86","title":"openssl_encrypt versions before 1.4.0 contain an arbitrary code execution vulnerability in the...","description":"openssl_encrypt versions before 1.4.0 contain an arbitrary code execution vulnerability in the Whirlpool hash implementation that uses broad glob patterns to load .so modules without integrity verification. Attackers can place malicious .so files matching the whirlpool*py313*.so pattern in site-packages directories to achieve native code execution when the module is loaded.","status":"published","published":"2026-08-17T12:32:22Z","modified":"2026-08-17T12:32:26Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-426"],"updated_at":"2026-11-02T15:10:34.0369Z"},{"id":"GHSA-j48q-4c78-rhf9","title":"openssl-encrypt: Dynamic .so loading for Whirlpool uses broad glob pattern without integrity verification","description":"## Severity: HIGH\n\n### Summary\n\nThe Whirlpool hash implementation in `openssl_encrypt/modules/registry/hash_registry.py` at **lines 570-589** uses glob patterns to find `.so` modules in site-packages and loads the first match via `importlib` without verifying module integrity.\n\n### Affected Code\n\n```python\nfor site_pkg in site.getsitepackages():\n    pattern = os.path.join(site_pkg, \"whirlpool*py313*.so\")\n    py313_modules = glob.glob(pattern)\n    if py313_modules:\n        module_path = py313_modules[0]  # Takes first match\n        loader = ExtensionFileLoader(\"whirlpool\", module_path)\n        spec = importlib.util.spec_from_file_location(\"whirlpool\", module_path, loader=loader)\n        whirlpool_module = importlib.util.module_from_spec(spec)\n        spec.loader.exec_module(whirlpool_module)\n```\n\n### Impact\n\nThe glob pattern `\"whirlpool*py313*.so\"` is broad and takes the first match without verifying:\n- File hash/signature\n- File ownership/permissions\n- Whether it's a legitimate module\n\nIf an attacker can place a malicious `.so` file matching this pattern in any site-packages directory, it will be loaded and native code executed.\n\n### Recommended Fix\n\n- Verify the module's integrity (hash or signature) before loading\n- Use a specific filename rather than a glob pattern\n- Check file permissions and ownership\n\n### Fix\n\nFixed in commit `963d0d1` on branch `releases/1.4.x` — added os.path.realpath() to resolve symlinks and validation that found .so files are within known site-packages directories before loading.","status":"published","published":"2026-03-31T23:31:29Z","modified":"2026-03-31T23:31:30Z","cvss":[{"version":"4.0","score":6.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U","level":"medium"}],"cwes":["CWE-427"],"updated_at":"2026-11-02T14:39:47.075804Z"}],"nvd":[{"id":"CVE-2026-74872","description":"openssl_encrypt versions before 1.4.0 contain an arbitrary code execution vulnerability in the Whirlpool hash implementation that uses broad glob patterns to load .so modules without integrity verification. Attackers can place malicious .so files matching the whirlpool*py313*.so pattern in site-packages directories to achieve native code execution when the module is loaded.","status":"published","published":"2026-08-17T11:16:41.56Z","modified":"2026-10-08T16:17:38.797Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-426"],"updated_at":"2026-11-02T14:12:38.647684Z"}],"osv":[{"id":"CVE-2026-74872","title":"openssl_encrypt before 1.4.0 Arbitrary Code Execution via Whirlpool","description":"openssl_encrypt versions before 1.4.0 contain an arbitrary code execution vulnerability in the Whirlpool hash implementation that uses broad glob patterns to load .so modules without integrity verification. Attackers can place malicious .so files matching the whirlpool*py313*.so pattern in site-packages directories to achieve native code execution when the module is loaded.","status":"published","published":"2026-08-17T11:04:41.525Z","modified":"2026-10-28T02:31:06.740025371Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"}],"cwes":["CWE-426"],"updated_at":"2026-11-02T15:45:16.748692Z"},{"id":"GHSA-j48q-4c78-rhf9","title":"openssl-encrypt: Dynamic .so loading for Whirlpool uses broad glob pattern without integrity verification","description":"## Severity: HIGH\n\n### Summary\n\nThe Whirlpool hash implementation in `openssl_encrypt/modules/registry/hash_registry.py` at **lines 570-589** uses glob patterns to find `.so` modules in site-packages and loads the first match via `importlib` without verifying module integrity.\n\n### Affected Code\n\n```python\nfor site_pkg in site.getsitepackages():\n    pattern = os.path.join(site_pkg, \"whirlpool*py313*.so\")\n    py313_modules = glob.glob(pattern)\n    if py313_modules:\n        module_path = py313_modules[0]  # Takes first match\n        loader = ExtensionFileLoader(\"whirlpool\", module_path)\n        spec = importlib.util.spec_from_file_location(\"whirlpool\", module_path, loader=loader)\n        whirlpool_module = importlib.util.module_from_spec(spec)\n        spec.loader.exec_module(whirlpool_module)\n```\n\n### Impact\n\nThe glob pattern `\"whirlpool*py313*.so\"` is broad and takes the first match without verifying:\n- File hash/signature\n- File ownership/permissions\n- Whether it's a legitimate module\n\nIf an attacker can place a malicious `.so` file matching this pattern in any site-packages directory, it will be loaded and native code executed.\n\n### Recommended Fix\n\n- Verify the module's integrity (hash or signature) before loading\n- Use a specific filename rather than a glob pattern\n- Check file permissions and ownership\n\n### Fix\n\nFixed in commit `963d0d1` on branch `releases/1.4.x` — added os.path.realpath() to resolve symlinks and validation that found .so files are within known site-packages directories before loading.","status":"published","published":"2026-03-31T23:31:29Z","modified":"2026-09-01T09:25:19.420612443Z","cvss":[{"version":"4.0","score":6.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U","level":"medium"}],"cwes":["CWE-427"],"updated_at":"2026-11-02T15:46:49.977351Z"},{"id":"PYSEC-2026-3742","description":"openssl_encrypt versions before 1.4.0 contain an arbitrary code execution vulnerability in the Whirlpool hash implementation that uses broad glob patterns to load .so modules without integrity verification. Attackers can place malicious .so files matching the whirlpool*py313*.so pattern in site-packages directories to achieve native code execution when the module is loaded.","status":"published","published":"2026-08-17T11:16:41.56Z","modified":"2026-09-01T09:15:03.518097029Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical"}],"updated_at":"2026-11-02T15:52:57.255153Z"}]}}