Read the docs
TI-2026-66486 Aliases GHSA-2vhw-q7vh-7xv2

openssl-encrypt's readiness endpoint leaks database error details to unauthenticated callers

Priority LOW 38CWE-201Published · Updated

Key facts

Attack vector
—
Privileges required
—
User interaction
—
Attack complexity
—
Impact type
Information disclosure
Confidentiality · integrity · availability
—
Fix status
Fixed

No CVSS vector from any source. Fix status from GitHub. Impact type from CWE-201.

Summary

### Summary The `/ready` endpoint in `openssl_encrypt_server/server.py` at **lines 159-175** catches database errors and returns the full exception string in the response. ### Affected Code ```python except Exception as e: return {"status": "not_ready", "reason": str(e)} ``` ### Impact Database exception messages can leak: - Database hostnames and IP addresses - Connection parameters and port numbers - Driver version information - Potentially database credentials if included in connection string errors This information is available to unauthenticated callers. ### Recommended Fix - Return a generic error message: `{"status": "not_ready", "reason": "database unavailable"}` - Log the full exception server-side for debugging ### Fix Fixed in commit `7aa8787` on branch `releases/1.4.x` — replaced str(e) with generic "database check failed" message; full exception logged server-side at WARNING level.

Why it matters now

Fix Fixed openssl-encrypt (PyPI): 1.4.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—openssl-encrypt (PyPI)before 1.4.01.4.0Patch availableGHSA-2vhw-q7vh-7xv2
  • openssl-encrypt (PyPI) Vendor— Affected before 1.4.0 Fixed in 1.4.0 Patch available GHSA-2vhw-q7vh-7xv2

Remediation

  • Fix · GHSA-2vhw-q7vh-7xv2 openssl-encrypt (PyPI) Fixed in 1.4.0 Advisory →

Timeline

  1. 2026-10-03 Threatist record created from GHSA-2vhw-q7vh-7xv2

References

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences