In limbo for 136 days
GHSA-vxf9-vwp6-2w43
openssl-encrypt on PyPI · published in jahlives/openssl_encrypt
Facts
- Severity
- Medium · CVSS score 6.2CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Package name
- openssl_encryptAs entered. Cleaned up for matching.
- Affected versions
- < 1.4.6As entered by the maintainer. Not reviewed.
- Fixed in
- 1.4.6 (the patch release that fixes this; format_version 13, commit 1c122790). The fix is also present in the upcoming 1.5.0 feature release, which ships on its own schedule.
- CVE
- None cited by the advisory
- GitHub Advisory Database
- Not reviewed
- OSV.dev
- Not present
- Other CVEs pointing here
- CVE-2026-74871 (published by another CNA)
If you use openssl-encrypt < 1.4.6
The fixed-version field says “1.4.6 (the patch release that fixes this; format_version 13, commit 1c122790). The fix is also present in the upcoming 1.5.0 feature release, which ships on its own schedule.”. Check the advisory for which version fixes it. Dependabot, npm audit and OSV-Scanner won’t flag this yet.
Timeline
2026-06-29 14:08 UTC
Published by the maintainers
No CVE cited
2026-10-28 07:20 UTC
First seen by Limbowatch
not reviewed · not in OSV
Waiting
Reviewed by GitHub
Waiting
In OSV; scanners can see it
Machine-readable record: feed/GHSA-vxf9-vwp6-2w43.json