https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 19:09:42 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-74870 <p>openssl_encrypt (pip) versions &lt;= 1.4.7 contain an information exposure vulnerability where the &#39;hsm fido2-test&#39; and &#39;hsm onlykey-test&#39; diagnostic commands unconditionally print the full derived hardware pepper as hex to stdout/stderr (crypt_cli.py, handle_hsm_command). The printed value can persist in terminal scrollback, session recordings, or CI logs. Impact is limited because the pepper is derived from a random per-invocation test salt and is salt-bound, so the leaked value cannot be used to decrypt real files. A related plugin issue logged raw prf_data outside the secret-redaction path. Fixed in 1.4.8 (and 1.5.0) by removing the hex dumps and routing plugin debug output through the redaction layer.</p> <p>openssl_encrypt (pip) versions &lt;= 1.4.7 contain an information exposure vulnerability where the &#39;hsm fido2-test&#39; and &#39;hsm onlykey-test&#39; diagnostic commands unconditionally print the full derived hardware pepper as hex to stdout/stderr (crypt_cli.py, handle_hsm_command). The printed value can persist in terminal scrollback, session recordings, or CI logs. Impact is limited because the pepper is derived from a random per-invocation test salt and is salt-bound, so the leaked value cannot be used to decrypt real files. A related plugin issue logged raw prf_data outside the secret-redaction path. Fixed in 1.4.8 (and 1.5.0) by removing the hex dumps and routing plugin debug output through the redaction layer.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-74870 https://vulnerability.circl.lu/vuln/ghsa-q9f6-q6m5-f5h2 <p>openssl_encrypt (pip) versions &lt;= 1.4.7 contain an information exposure vulnerability where the &#39;hsm fido2-test&#39; and &#39;hsm onlykey-test&#39; diagnostic commands unconditionally print the full derived hardware pepper as hex to stdout/stderr (crypt_cli.py, handle_hsm_command). The printed value can persist in terminal scrollback, session recordings, or CI logs. Impact is limited because the pepper is derived from a random per-invocation test salt and is salt-bound, so the leaked value cannot be used to decrypt real files. A related plugin issue logged raw prf_data outside the secret-redaction path. Fixed in 1.4.8 (and 1.5.0) by removing the hex dumps and routing plugin debug output through the redaction layer.</p> <p>openssl_encrypt (pip) versions &lt;= 1.4.7 contain an information exposure vulnerability where the &#39;hsm fido2-test&#39; and &#39;hsm onlykey-test&#39; diagnostic commands unconditionally print the full derived hardware pepper as hex to stdout/stderr (crypt_cli.py, handle_hsm_command). The printed value can persist in terminal scrollback, session recordings, or CI logs. Impact is limited because the pepper is derived from a random per-invocation test salt and is salt-bound, so the leaked value cannot be used to decrypt real files. A related plugin issue logged raw prf_data outside the secret-redaction path. Fixed in 1.4.8 (and 1.5.0) by removing the hex dumps and routing plugin debug output through the redaction layer.</p> https://vulnerability.circl.lu/vuln/ghsa-q9f6-q6m5-f5h2 https://vulnerability.circl.lu/vuln/pysec-2026-3956 <p><strong>Affected:</strong> PyPI: openssl-encrypt</p> <p>openssl_encrypt (pip) versions &lt;= 1.4.7 contain an information exposure vulnerability where the &#39;hsm fido2-test&#39; and &#39;hsm onlykey-test&#39; diagnostic commands unconditionally print the full derived hardware pepper as hex to stdout/stderr (crypt_cli.py, handle_hsm_command). The printed value can persist in terminal scrollback, session recordings, or CI logs. Impact is limited because the pepper is derived from a random per-invocation test salt and is salt-bound, so the leaked value cannot be used to decrypt real files. A related plugin issue logged raw prf_data outside the secret-redaction path. Fixed in 1.4.8 (and 1.5.0) by removing the hex dumps and routing plugin debug output through the redaction layer.</p> <p><strong>Affected:</strong> PyPI: openssl-encrypt</p> <p>openssl_encrypt (pip) versions &lt;= 1.4.7 contain an information exposure vulnerability where the &#39;hsm fido2-test&#39; and &#39;hsm onlykey-test&#39; diagnostic commands unconditionally print the full derived hardware pepper as hex to stdout/stderr (crypt_cli.py, handle_hsm_command). The printed value can persist in terminal scrollback, session recordings, or CI logs. Impact is limited because the pepper is derived from a random per-invocation test salt and is salt-bound, so the leaked value cannot be used to decrypt real files. A related plugin issue logged raw prf_data outside the secret-redaction path. Fixed in 1.4.8 (and 1.5.0) by removing the hex dumps and routing plugin debug output through the redaction layer.</p> https://vulnerability.circl.lu/vuln/pysec-2026-3956