openssl-encrypt's readiness endpoint leaks database error details to unauthenticated callers
Key facts
- Attack vector
- —
- Privileges required
- —
- User interaction
- —
- Attack complexity
- —
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- —
- Fix status
- Fixed
No CVSS vector from any source. Fix status from GitHub. Impact type from CWE-201.
Summary
### Summary The `/ready` endpoint in `openssl_encrypt_server/server.py` at **lines 159-175** catches database errors and returns the full exception string in the response. ### Affected Code ```python except Exception as e: return {"status": "not_ready", "reason": str(e)} ``` ### Impact Database exception messages can leak: - Database hostnames and IP addresses - Connection parameters and port numbers - Driver version information - Potentially database credentials if included in connection string errors This information is available to unauthenticated callers. ### Recommended Fix - Return a generic error message: `{"status": "not_ready", "reason": "database unavailable"}` - Log the full exception server-side for debugging ### Fix Fixed in commit `7aa8787` on branch `releases/1.4.x` — replaced str(e) with generic "database check failed" message; full exception logged server-side at WARNING level.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | openssl-encrypt (PyPI) | before 1.4.0 | 1.4.0 | Patch available | GHSA-2vhw-q7vh-7xv2 |
- openssl-encrypt (PyPI) Vendor— Affected before 1.4.0 Fixed in 1.4.0 Patch available GHSA-2vhw-q7vh-7xv2
Remediation
- Fix · GHSA-2vhw-q7vh-7xv2 openssl-encrypt (PyPI) Fixed in 1.4.0 Advisory →
Timeline
- 2026-10-03 Threatist record created from GHSA-2vhw-q7vh-7xv2
References
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences