Read the docs
TI-2026-66475 Aliases GHSA-425g-fjhq-5h92

openssl-encrypt silently skips schema validation when jsonschema library is not installed

Priority LOW 38CWE-20Published · Updated

Key facts

Attack vector
—
Privileges required
—
User interaction
—
Attack complexity
—
Impact type
—
Confidentiality · integrity · availability
—
Fix status
Fixed

No CVSS vector from any source. Fix status from GitHub.

Summary

### Summary In `openssl_encrypt/modules/json_validator.py` at **lines 234-238**, when the `jsonschema` library is not installed, all schema validation is silently skipped with only a print warning. ### Affected Code ```python if not JSONSCHEMA_AVAILABLE: print(f"Warning: Cannot validate against schema '{schema_name}' - jsonschema library not available") return ``` Additionally, unknown metadata format versions (line 288-293) bypass schema validation entirely, and all schemas use `additionalProperties: true` allowing arbitrary extra fields. ### Impact An attacker who can influence the Python environment (remove the jsonschema package) or craft metadata with an unknown version number can bypass all schema checks. Malformed or malicious metadata will be accepted without validation. ### Recommended Fix - Make `jsonschema` a required dependency, not optional - Or fail-closed: refuse to process metadata when validation cannot be performed - Reject unknown format versions instead of silently skipping validation - Consider using `additionalProperties: false` in schemas ### Fix Fixed in commit `6e7f938` on branch `releases/1.4.x` — validate_against_schema() now raises JSONValidationError when jsonschema is unavailable instead of silently passing; changed print() warning to logging.warning().

Why it matters now

Fix Fixed openssl-encrypt (PyPI): 1.4.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—openssl-encrypt (PyPI)before 1.4.01.4.0Patch availableGHSA-425g-fjhq-5h92
  • openssl-encrypt (PyPI) Vendor— Affected before 1.4.0 Fixed in 1.4.0 Patch available GHSA-425g-fjhq-5h92

Remediation

  • Fix · GHSA-425g-fjhq-5h92 openssl-encrypt (PyPI) Fixed in 1.4.0 Advisory →

Timeline

  1. 2026-10-03 Threatist record created from GHSA-425g-fjhq-5h92

References

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences